GDPR complaints procedure
Contents
- Scope
1. Scope
1.1 This procedure addresses complaints from data subject(s) related to the processing of their personal data, Uttlesford District Council's handling of requests from data subjects, and appeals from data subjects on how complaints have been handled.
2. Responsibilities
2.1 All members of council staff are responsible for ensuring any complaints made in relation to the scope of this procedure are reported to the Data Protection Officer.
2.2 The Data Protection Officer is responsible for dealing with all complaints in line with this procedure.
3. Procedure
3.1 Uttlesford District Council as data controller will supply the contact details of our Data Protection Officer on our website which is clearly defined.
3.2 The council has clear guidelines on this web page and any complaint is sent directly to the Data Protection Officer's mailbox, to enable the data subject to lodge a formal complaint.
3.3 The council provides data subject(s) with details of our privacy notice and we have published this document on our website.
3.4 Data subjects are able to complain to the council about:
- how their personal data has been processed;
- how their request for access to their data has been handled;
- how their complaint has been handled;
- how to appeal against any decision made following a complaint.
3.5 Data subject(s) seeking to lodge a complaint are able to do so direct to the Data Protection Officer whose email details are dpo@uttlesford.gov.uk
- Complaints received are directed to the Data Protection Officer for resolution.
- Where any complaint refers to the council's handling of a subject access request the DPO will immediately refer the matter to the councils Monitoring Officer (Head of Legal) who will cause the matter to be investigated.
- The council will endeavour to resolve any complaints received wherever possible within one month.
- Appeals on the handling of complaints are to be resolved where possible within ten (10) working days.
3.6 In the event that Uttlesford District Council should fail to act on a data subject's access request within one month, or refuses the request, it will set out in clear and plain language the reasons it took no action or refused the request.
3.7 The council will also inform the data subject(s) at that time of their right to complain directly to the supervisory authority. In doing so, the council will provides the data subject(s) with the contact details of the supervisory authority, (the Information Commissioners Office) and will inform the data subject of their right to seek judicial remedy.
Document owner
The Data Protection Officer is the owner of this document and is responsible for ensuring that this procedure is reviewed in line with the requirements of the GDPR.
Change history record
New document: (1st publication)
Approval: Simon Pugh (Assistant Director Governance & Legal)
Date of issue: 23 May 2018
Biennial review by DPO to ensure currency and compliance with Data Protection Legislation
Approval: Simon Pugh (Assistant Director Governance & Legal)
Date of issue: June 2020