Site menu

Data Protection Complaints procedure

1. Purpose

This procedure outlines how Norfolk County Council handles data protection complaints raised under the UK GDPR, Data Protection Act 2018, and the Data (Use and Access) Act 2025.

2. What is a Data Protection Complaint?

A data protection complaint relates to how the Council has handled someone's personal data, including concerns such as:

  • Delays or issues with Subject Access Requests (SARs)
  • Alleged unlawful processing
  • Inaccurate or incomplete data
  • Data breaches or mishandling
  • Concerns about retention, security, or sharing
  • Failure to uphold information rights

3. How to Make a Data Protection Complaint to Norfolk County Council

Individuals can make a complaint using any of the following routes:

  • Online form Make a complaint
  • Telephone 0344 800 8020
  • Letter addressed to:
    Information Governance Team
    Norfolk County Council
    County Hall
    Martineau Lane
    Norwich
    NR1 2DH
  • Other contact methods can be found here - Contact us

When submitting a complaint, individuals should provide:

  • Contact details
  • Reference numbers (e.g., SAR, IG) if applicable
  • Description of what happened
  • Why they believe data protection law was not followed and what outcome they are seeking
  • Any relevant evidence

4. Investigation

The officer considering the complaint will usually be within the Information Governance Service and will have appropriate data protection experience to be able to provide a considered response.

The officer will:

  1. Review the complaint and any evidence
  2. Identify relevant systems, records, and staff
  3. Compare actions against law, NCC policy, and ICO guidance

6. Outcome

When the investigation concludes, Norfolk County Council will provide:

  • A clear explanation of findings
  • Any corrective action taken
  • Whether the Council agrees, partially agrees, or does not uphold the complaint
  • Information about the complainant's right to escalate to the ICO

Norfolk County Council aims to respond to these complaints without undue delay and usually within one calendar month of the acknowledgment.

7. Escalation to the Information Commissioners Office (ICO)

While an individual can contact the ICO at any time regarding data related matters, if the individual remains dissatisfied after receiving the Council's response, the matter can be escalated to the ICO. Further information can be found on their website at: 

Information Commissioner's Office

8. Record‑Keeping

Norfolk County Council will record your complaint including:

  • Correspondence connected to the complaint
  • Outcome of the complaint
  • Any actions as a result of the complaint

These records will be kept in line with the timescales detailed in our retention schedule.

9. Interaction with Other Procedures

Complaints relating to data protection that also include concerns about other Council services will be considered under the relevant alternative complaints procedures.

More information about the Council's complaint procedures can be found on our website at Corporate complaints policy.

10. Unreasonable behaviour and persistent complaints

The County Council reserve the right not to consider complaints that:

  • Are malicious (that is, they are instituted without sufficient grounds and serving only to cause annoyance).
  • Use obscenities, racist or homophobic language.
  • Contain personally offensive remarks about members of staff.
  • Are repeatedly submitted with only minor differences after we have fully addressed the complaint.

Complaints of this nature or in the event complainants are pursuing complaints in unreasonable ways, the Unreasonable persistent complaints policy.

11. Confidentiality

Complaints made to the County Council will be treated in confidence.

Complaints will only pass the details of the complaint to those County Council staff members and partner organisations who need to know in order to investigate it.

Confidentiality cannot be guaranteed where a vulnerable person is considered to be at risk and safeguarding procedures apply. In these circumstances, the County Council may have to share the information with other departments within the Council or other external agencies.

Customers who make their complaints public in the media may forfeit their right to anonymity and the right to confidentiality.

12. Service Requests

Requests to receive a specific service, assistance, information, or improvements to a service or resolution to a problem, will be considered as a service request. In these cases, the relevant service area will take appropriate action in response.

Share this page