Independent consumer guide. Not affiliated with Fox & Sons or Connells Group. Not legal advice.
The Information Commissioner’s Office (ICO) is the UK’s data protection regulator. If a company mishandles your personal data — ignores or under-delivers on your DSAR, holds inaccurate information about you, makes false statements about you in its records, or shares your data improperly — the ICO is where that goes.
When to complain to the ICO
- Your DSAR deadline passed (one calendar month) with no response or an incomplete response
- The company holds inaccurate personal data about you and won’t correct it (you have a right to rectification under Article 16)
- Your data was shared or used in ways you weren’t told about
- Serious false statements about you appear in their records or correspondence
Before you file
The ICO expects you to raise the issue with the organisation first. Do this in writing, call it what it is (“I am raising a data protection concern”), and give them a chance to respond. Keep their response — or note their silence. The ICO also expects complaints to be brought promptly, generally within three months of your last meaningful contact with the organisation about the issue, so don’t let it drift.
How to file
- Go to ico.org.uk and use “Make a complaint”
- Choose the route that fits: a complaint about a Subject Access Request, or about how your data has been handled generally
- Attach your paper trail: the DSAR, their response (or lack of one), your correction request, and your dated timeline
- State the outcome you want: full disclosure, correction of inaccurate records, or both
What the ICO can realistically do
Be clear-eyed about this:
- The ICO does not award compensation — money goes through TPO or the courts
- It can assess whether the company breached data protection law, require action, issue reprimands, and in serious cases take enforcement action
- An ICO complaint on file creates regulatory pressure — companies respond differently once a regulator is watching
- An ICO outcome supporting your position is powerful evidence in any parallel Ombudsman case or court claim
The combination play
The strongest position is running the tracks together: DSAR to obtain the evidence → correction request for anything false → ICO if they fail on either → TPO for the service failure and compensation. Each route reinforces the others, and none of them costs you a penny.