Your right to make a data protection complaint

The council is committed to handling your personal information lawfully, fairly, and transparently. If you are unhappy with how we have collected, used, shared, or looked after your personal information, you have the right to raise a complaint with us.

This page explains:

• when you can make a data protection complaint
• how to raise your complaint with us
• what you can expect from our complaints process
• your right to escalate your complaint to the Information Commissioner’s Office (ICO)

When you can make a data protection complaint

You can complain to us if you believe we have not handled your personal information properly. Examples include where you think we have:

• not responded properly to a request for your personal information
• kept inaccurate information about you
• shared your information incorrectly
• kept information for longer than necessary
• used your information for a different purpose than it was collected for
• mishandled or failed to secure your information
• not upheld your data protection rights

Under the Data (Use and Access) Act 2025, you now have a formal statutory right to make a complaint directly to us about any breach of the UK GDPR or the Data Protection Act 2018.

You must raise your concern with us before escalating it to the ICO.

How to make a data protection complaint

You can make a data protection complaint using any of the following methods:

Our recommended method is to use our online form:

Data protection complaint form

If your're unable to use the online form you can contact us by:

• Email: information.governance@york.gov.uk
• Telephone: 01904 555719

Or write to:

When contacting us, please include:

• your full name and contact details
• a clear description of your complaint
• any relevant dates or correspondence
• if applicable, any reference numbers (for example, for an information request)

Please do not send original documents; copies are sufficient.

What you can expect from us

In line with the statutory requirements in the Data (Use and Access) Act 2025 and ICO guidance, we will:

• acknowledge your complaint within 30 days of receiving it
• investigate without undue delay, including making any necessary enquiries
• keep you informed about the progress of our investigation
• provide a clear written outcome, explaining our findings and any actions taken

Our aim is to resolve your complaint as early as possible and to ensure our handling of personal information is accountable, transparent, and fair.

If you're not satisfied with our response

If you remain unhappy after receiving our final response, or if you believe we have failed to properly handle your complaint, you have the right to escalate the matter to the ICO.

The ICO is the UK’s independent regulator for data protection. They can give advice, investigate complaints, and take action where organisations fail to comply with data protection law.

You can contact the ICO on their website: Information Commissioner’s Office.

Or you can write to them at:

Accessibility and alternative formats

We want this information to be accessible to everyone. If you need this page in a different format, such as large print, audio, Braille, or another language, please contact the Information Governance Team.

If you need further help

If you’re unsure whether your complaint relates to data protection, or you need support making a data protection complaint, contact the Information Governance Team for help.

Also see

• Our Data Protection Policy Statement
• Right of access to your personal data
• Information requests