ou must have a process for handling data protection complaints within your organisation.

Data protection complaints can come from anyone who’s unhappy with how you’ve handled their personal information. For example, they may come from people who:

• are unhappy with your response to their subject access request (SAR), or other rights request;
• have been impacted by a data breach, regardless of whether it’s reportable to us; or
• are unhappy about the way you’ve used their personal information (eg where you’ve store it, how long you’ve kept it for, or its accuracy).

Read this guide to ensure you are familiar with what you must, should and could do.