Internal Privacy Complaints Procedure

This document outlines the internal privacy complaint procedure for Jane Galley trading as Loopy’s Place In order to comply with our obligations under the GDPR and DUAA, and in order to deliver a high level of service to our customers this documentation outlines the internal timescales and procedure for handling complaints.

Timetable for handling complaints
Complaint Received: Check content of complaint relates to the correct company and potentially relevant issue. Is this complaint against us or could it be against a similar named company or third party? Check whether this is purely a complaint or whether there is a Subject Access Request element too. (If a SAR then follow SAR procedure).
Verity the complainant’s identity: If we have any doubts about the complainant’s identity, we may need to ask them for proof of ID before we respond. We should make sure we ask for it at the earliest opportunity. If we have sufficient information to be satisfied about the requester’s identity, we must not request more information.
Schedule a deadline reminder for acknowledging the complaint: Legally this must be responded to within 30 days of receipt. The 30 days start the day after we receive the complaint. It doesn’t matter if this day falls on a weekend or a public holiday. The 30 days still start on this day. If the last day to acknowledge the complaint falls on a weekend or public holiday, we have until the next working day to provide an acknowledgement. We can acknowledge sooner, before the 30 days expire.
Schedule fortnightly update reminders, so that we can keep the complainant updated.
Prepare and send the acknowledgement email: (see example email below). There is no obligation to outline a timeframe for responding. Ensure that we have enough information to fully investigate and respond. Do not make assumptions about what we think the issue is about. Ask for more information if needed. Assess whether it would be appropriate to ask what outcome they are looking for, e.g. to alter a decision, provide am apology or change our processes.
Begin investigations: consider what evidence needs to be preserved and gather information. We are required to look at all of the relevant facts thoroughly, fairly and accurately. We are required to speak to relevant team members. As part of our investigation we should compare the information we hold with the information provided within the complaint. At all times we should ensure that we have and that we continue to uphold our own terms, policies and standards.
Send fortnightly updates: in order to adhere to legal obligation to keep complainant updated. Send update even if there is little to report save for the fact that the investigation is ongoing and it is too early to provide a substantive response.
Send outcome email: and remind them again that they can complain to the ICO directly.

Example Acknowledgement Email – Must be sent within 30 days of receipt.
Dear [ENTER NAME]
We are in receipt of your email dated [DATE] in which you raised a complaint relating to [SUMMARY OF COMPLAINT].
At this point we believe that we have sufficient information to fully investigate your complaint OR We are unable to fully investigate your complaint because [OUTLINE ANY UNCLEAR ISSUES/FURTHER INFORMATION NEEDED]
In order to comply with our data protection obligations we will now proceed to investigate your complaint. Our aim is to investigate your complaint fully and then provide you with the outcome of our investigation by email.
At this stage we are not able to provide you with a date by when our investigations will be concluded, but we will provide you with fortnightly updates.
The investigation will be conducted as objectively as possible and the person in charge of the leading the investigation and preparing an outcome response will be Jane Galley. We take all complaints that we receive seriously and aim to investigate and respond promptly.
You are entitled to raise your complaint directly to the Information Commissioner’s Office (ICO). You should be aware that you are not legally obliged to wait for our investigation response before you raise a complaint with the ICO.
Should you have any questions or concerns at this initial stage, please do not hesitate to contact me directly.
Yours sincerely,
Jane Galley