How to Complain to the ICO About Your Data (UK Guide)

TL;DR: Complain to the organisation first. Since 19 June 2026, under the Data (Use and Access) Act, every organisation must have a data protection complaints process and acknowledge complaints within 30 days. If you're unhappy with the outcome, complain to the ICO, ideally within three months of your last meaningful contact with the organisation, and include copies of your letters, emails and their replies. The ICO's online questionnaire tells you if it can look into your case.

👉 Free check covers your email in 30 seconds — full scan adds your phone number →

What the ICO can help with

The Information Commissioner's Office (ICO) is the UK regulator for data protection. You can complain to it if an organisation:

Ignored or mishandled a subject access request
Refused to correct or delete your data without good reason
Lost your data in a breach, or didn't tell you about one that put you at high risk
Kept sending marketing after you objected
Shared your data without a lawful basis

The ICO decides whether an organisation has broken the law and can require it to act, but it does not award compensation. For money, you'd need to go to court or a claims route.

Step 1: Complain to the organisation

The ICO asks you to raise your concern with the organisation first and give it a chance to put things right. This is now backed by law. From 19 June 2026, the Data (Use and Access) Act requires every organisation to have a process for data protection complaints. According to DLA Piper's summary:

Organisations must give you a way to complain directly, and the ICO expects them to accept complaints through any channel.
They must acknowledge your complaint within 30 days.
They must investigate without undue delay, keep you updated and tell you the outcome.
They must tell you that you can then complain to the ICO, with its contact details.

Write your complaint clearly: what happened, which right you're relying on, what you want them to do, and the date. Keep a copy.

Step 2: Complain to the ICO

Start the ICO's online questionnaire, which takes about five minutes and tells you whether you can complain or need to take another step first.
Do it promptly. The ICO says you should raise your complaint within three months of your last meaningful contact with the organisation.
Attach evidence: your original request or complaint, their replies, notes of calls and any documents that show the problem.
Explain clearly what's wrong, for example information missing from a SAR, or data blacked out without reason.

You can also call the ICO helpline on 0303 123 1113 or use its live chat.

What happens next

The ICO considers the complaint and tells you the outcome. It may contact the organisation, ask it to fix the problem, or decide no further action is needed. Serious or repeated failures can lead to formal enforcement, but most complaints are resolved by the ICO telling the organisation what it should do.

Common complaints that work

Unanswered SARs. Most organisations must reply within one month; see our SAR guide.
Marketing calls and texts after you opted out or registered with the Telephone Preference Service.
Data brokers and people-search sites that won't remove you; see our UK data broker opt-out guide.
Companies holding more than they need, which breaks the data minimisation principle.

If your complaint is about a breach, find out what was taken first. A free email exposure check shows which known breaches include your email.

Frequently Asked Questions

Do I have to complain to the organisation before the ICO?

Yes. The ICO recommends raising your concern with the organisation first, and since 19 June 2026 organisations must have a complaints process for data protection issues.

Is there a time limit to complain to the ICO?

The ICO says you should complain within three months of your last meaningful contact with the organisation.

How long does an organisation have to respond to a data protection complaint?

Under the Data (Use and Access) Act rules in force from 19 June 2026, it must acknowledge your complaint within 30 days and respond without undue delay.

Can the ICO get me compensation?

No. The ICO can require an organisation to act, but compensation has to be sought through the courts or another claims route.

What is the ICO phone number?

The ICO helpline number is 0303 123 1113. It also offers live chat.

How to Complain to the ICO About How a Company Handled Your Data