How to Complain to the ICO About Your Data
If a UK organisation mishandles your data or ignores your request, the ICO is the next step. There is an order to follow, and a time limit.
By Siddharth ShankarUpdated October 20, 2026Complain to the organisation first, in writing, and give it one calendar month to respond. If you are still unhappy, complain to the Information Commissioner’s Office within three months of your last substantive contact with the organisation. The ICO can give advice and ask the organisation to resolve the issue, but it cannot award compensation or act as your representative. You can also take the matter to court, after getting legal advice.
Your email is the key to most of your accounts. Has it already leaked?
Free · About 30 seconds · No sign-up · Email not stored
The ICO is the UK regulator for data protection. People most often contact it after a subject access request or an erasure request has been ignored or refused, or after a data breach.
Step one: complain to the organisation
The ICO’s guidance says you should complain to the organisation first. Do it in writing, say what went wrong and ask for a response within one calendar month. Keep a copy of everything you send and every reply.
Step two: complain to the ICO
If the organisation does not respond, or you are not satisfied, you can complain to the ICO. The guidance says to do so within three months of your last substantive contact with the organisation. You can use the form on the ICO’s make a complaint page, live chat, or call 0303 123 1113.
Quick check before you read on: is your email in a known data breach? Free, about 30 seconds.
Free · About 30 seconds · No sign-up · Email not stored
What to include
- The name of the organisation and how you dealt with it.
- What you asked for and the dates, such as the date of your request.
- The organisation’s reply, or confirmation that you got none.
- Copies of key letters and emails.
- What you want to happen next.
What the ICO can do
The ICO says it can advise you and ask the organisation to resolve the matter. It cannot award compensation, and it cannot act as your representative. If you want compensation, you would need to pursue a claim separately.
Going to court
You can also take the organisation to court. The ICO page advises getting legal advice before deciding to do so. Court action can be expensive and slow, so consider it carefully.
Common reasons to complain
- A subject access request was ignored, late or incomplete. See how to make a subject access request.
- A request to delete data was refused. See how to ask a UK organisation to erase your data.
- Your data was exposed in a breach and you were not told.
- Unwanted marketing continues after you opted out. See the Telephone Preference Service.
Writing the complaint to the organisation
Your first letter or email sets the tone and creates the record the ICO will look at. Keep it short and clear. State who you are, what you asked for and when, what happened, and what you want the organisation to do. Say that you expect a reply within one calendar month. Send it in a way that leaves a record, such as email, and keep a copy.
A simple template to adapt
- Opening: say you are complaining about how your personal data was handled.
- Facts: set out the dates and what you requested or what went wrong.
- Outcome wanted: say what you expect, such as a full response to your request.
- Deadline: ask for a reply within one calendar month.
- Next step: say that you may raise the matter with the ICO if it is not resolved.
After you have complained to the ICO
The ICO will look at what you send and may ask the organisation to respond. Keep your records handy in case it asks for more information, and tell the ICO if anything changes. Be realistic about the outcome: the ICO focuses on whether the organisation has met its obligations, and it does not decide compensation claims.
Tips for a stronger complaint
1Be factual
State what happened, with dates, not how you feel about it.
2Cite your request
Refer to the date and wording of your original request.
3Stay within the limit
Count the three months from your last substantive contact, not from the first problem.
4Keep records
Save screenshots, emails and letters in one folder.
This page is general information, not legal advice. Check the ICO’s website for the current process.
Sources
- ICO: What to do if the organisation does not respond or you are dissatisfied (complain to organisation first, one month, three months limit, ICO powers, court option)
- ICO: Make a complaint (contact routes for complaints)
Frequently asked questions
Do I have to complain to the organisation first?
Yes. The ICO says to complain to the organisation first, in writing, and give it a calendar month to reply.
What is the time limit for complaining to the ICO?
Within three months of your last substantive contact with the organisation.
Can the ICO get me compensation?
No. It can advise and ask the organisation to resolve the matter, but cannot award compensation.
How can I contact the ICO?
Use the online form, live chat or call 0303 123 1113.
Can I go to court instead?
Yes, but get legal advice first.
See if your email has already leaked
- Checks your email against known data breaches
- Shows which sites leaked it, when, and what leaked
- We do not store the email you check
Compare data removal services
See which services work in your country, what they cost, and the free do-it-yourself route.
Compare removal services →Prefer a one-time report first? Scan My Shadow, our sister service, $9.99.