Skip to content

Data protection complaints procedure

Last updated: [DATE]

Your right to complain to us

Section 103 of the Data (Use and Access) Act 2025 gives you a right to complain directly to the organisation that controls your personal data if you think it has broken data protection law. Those rules came into force on 19 June 2026 and require us to acknowledge your complaint within 30 days, look into it properly and tell you the outcome without undue delay. This page explains how we do that for caninebreeder.co.uk, operated by [COMPANY NAME] (ICO registration number [ICO REGISTRATION NUMBER]).

You do not need to use this procedure before going to the Information Commissioner’s Office (ICO), but the ICO normally expects you to have raised the matter with us first, and complaining to us is usually the fastest way to put things right.

What counts as a complaint

Any expression of dissatisfaction about how we have handled your personal data under the UK GDPR or the Data Protection Act 2018. Examples:

You do not have to use the word “complaint”. If you tell us something has gone wrong with your data, we treat it as one.

A request to see, correct or delete your data is a rights request, not a complaint. Send those to [EMAIL] and we respond within one month. If we then fail to act, that failure can become a complaint.

How to complain

Please include your name, the email address you used on the Site, what happened and when, what you would like us to do, and any evidence such as screenshots or emails. Complaining is free. Someone else, such as a family member or solicitor, can complain for you if you give them written authority.

What we do

  1. Acknowledge your complaint within 30 days of receiving it. In practice we aim to acknowledge within 5 working days. The acknowledgement gives you a reference number and the name of the person handling it.
  2. Investigate without undue delay. The investigation is proportionate to the seriousness and complexity of what you have raised. We look at our systems, logs and correspondence, and we may ask you for more information.
  3. Keep you informed if the investigation is going to take longer than expected, and tell you why.
  4. Respond with our findings without undue delay. Our target is a full response within 30 days of acknowledgement, and no later than 90 days for the most complex cases. The response tells you what we found, whether we agree that something went wrong, what we have done or will do to fix it, and how to escalate if you disagree.

Where we find a problem, we put it right: for example by correcting or deleting data, stopping the processing you objected to, changing a process or retraining staff. If a personal data breach is involved, we also follow our breach procedure, which may include notifying the ICO within 72 hours and notifying you.

Who handles your complaint

Our Data Protection Lead handles complaints. If the complaint is about the Lead’s own actions, a director who was not involved handles it instead. We do not treat you differently for complaining.

Escalating to the ICO

If you are not satisfied with our response, or we have not responded, you can complain to the Information Commissioner’s Office:

The ICO asks you to complain within three months of your last meaningful contact with us. You can also apply to the court for compensation if you have suffered damage or distress because we broke data protection law.

Records

We log every complaint, our acknowledgement date, the investigation and the outcome, and keep those records for 6 years. We review complaint trends at least once a year and report figures to the ICO if it asks us to.

Related pages