{"content":{"layouts":[{"type":"singleColumn","areas":[{"items":[{"type":"Plain","cta":"","body":"\u003Cp\u003EFollowing the implementation of the Data (Use and Access) Act this toolkit is under review and will be updated over the coming months. For more information about the Data (Use and Access) Act\u0026nbsp;please\u00A0\u003Ca rel=\u0022noopener\u0022 href=\u0022https://ico.org.uk/about-the-ico/what-we-do/legislation-we-cover/data-use-and-access-act-2025/the-data-use-and-access-act-2025-what-does-it-mean-for-organisations/\u0022 target=\u0022_blank\u0022 title=\u0022The Data Use and Access Act 2025 (DUAA) - what does it mean for organisations? | ICO\u0022\u003Esee the ICO guidance\u003C/a\u003E.\u003C/p\u003E","link":null,"colour":"#006ddf","title":"","image":null,"imageFocus":"","imageId":0,"imageKey":"00000000-0000-0000-0000-000000000000","imageCrop":"","gridType":"card","gtmId":"","gtmClass":""},{"gridType":"RichTextBlock","content":"\u003Cp\u003EFrom 19 June 2026 all organisations are required to have a process in place for handling data protection complaints.\u003C/p\u003E\n\u003Cp\u003EData protection complaints can happen when someone is unhappy with how their data has been used, how long it has been kept, its accuracy, how securely it has been stored, or how their rights requests (such as subject access requests) have been handled. They may also complain if they have been affected by a data breach.\u003C/p\u003E\n\u003Cp\u003EComplaints could come from parents, young people, adult members and anyone else whose data has been processed by your Scout Unit.\u003C/p\u003E\n\u003Cp\u003EBelow we run through how to manage data protection complaints.\u003C/p\u003E","gtmId":"","gtmClass":""},{"gridType":"RichTextBlock","content":"\u003Ch4\u003EProvide a clear way for people to complain\u003C/h4\u003E\n\u003Cp\u003EYou must give individuals a straightforward way to raise data protection concerns directly with your Scout Unit. You should also tell people they can raise a complaint, and a good way to do this is to include it in your Data Protection Policy and your website.\u003C/p\u003E\n\u003Cp\u003EYou should provide a dedicated email address or contact point alongside a simple explanation of what information they should provide. This should be easily accessible so people know how they can raise a data protection complaint. \u0026nbsp;Data protection complaints can be from adults or from young people, and so any mechanisms you have should be suitable for all.\u00A0\u003C/p\u003E","gtmId":"","gtmClass":""},{"gridType":"RichTextBlock","content":"\u003Ch4\u003EWhat to do if you receive a data protection complaint\u003C/h4\u003E\n\u003Cp\u003E\u003Cstrong\u003E1 Acknowledge the complaint\u003C/strong\u003E\u003Cbr\u003EWhen a complaint is received you should acknowledge it promptly. The law says it should be acknowledged within 30 days but you should plan to acknowledge it much sooner than that. You will need to confirm the complainant\u2019s identity. If you have any doubts, you should ask them for proof of ID. \u0026nbsp;If someone is making a complaint on behalf of someone else you should check that they have the authority to do so.\u003C/p\u003E\n\u003Cp\u003E\u003Cstrong\u003E2 Investigate\u003C/strong\u003E\u003Cbr\u003EYou need to ensure the correct people are aware of the complaint, and are allocated to investigate. In most cases this will be Lead Volunteer or Data Lead. You should also ensure the Trustee Board are made aware. You should be sensitive to who the complaint is about, and who is involved or connected to those involved. \u0026nbsp;\u003C/p\u003E\n\u003Cp\u003EWhere a data protection complaint also includes other matters of complaint, consideration should be given as to whether to investigate them together or to separate them.\u003C/p\u003E\n\u003Cp\u003EYour investigation should be proportionate and timely. This should include a review of the data processing involved, and whether it was done in line with your policies and data protection law. If you determine that there has been a problem, then you should consider the volume and type of data involved, and the level of risk associated with it. If you believe that there has been a data breach you should follow \u003Ca href=\u0022/volunteers/running-things-locally/gdpr-toolkit/step-12-responding-to-a-breach/\u0022 title=\u0022Step 12: Responding to a breach\u0022\u003EStep 12: Responding to a breach.\u003C/a\u003E\u003C/p\u003E\n\u003Cp\u003E\u003Cstrong\u003E3. Keep the complainant updated\u003C/strong\u003E\u003Cbr\u003EThe complainant should be kept informed of the progress of the investigation. They should be given a timescale in which you will respond. We recommend responding to complaints within one calendar month, or if it is complex you can extend by a further two months. Where there are delays you should ensure you keep the complainant informed.\u003C/p\u003E\n\u003Cp\u003E\u003Cstrong\u003E4. Keep a record\u003C/strong\u003E\u003Cbr\u003EYou should keep a record of all data protection complaints. This should include the date it was received, when you acknowledged it and responded to it. You should also retain records of communication and any actions taken. It is possible that the Information Commissioner could request to see your complaint log. Something like an excel spreadsheet is an ideal tool for a complaint log. The log must be stored securely and access only given to those who need it.\u003C/p\u003E\n\u003Cp\u003E\u003Cstrong\u003E5. Respond to the Complaint\u0026nbsp;\u003C/strong\u003E\u003Cbr\u003EThe most common route for responding to a complaint is via email, though they can also be responded to via a letter or a conversation. The response should include:\u003C/p\u003E\n\u003Cul\u003E\n\u003Cli\u003EAn explanation of your findings\u003C/li\u003E\n\u003Cli\u003EAny actions you have taken or will take\u003C/li\u003E\n\u003Cli\u003EDetails of how you have complied with data protection law\u003C/li\u003E\n\u003Cli\u003EDetails of how to complain to the Information Commissioners Office \u0026nbsp;\u003C/li\u003E\n\u003C/ul\u003E\n\u003Cp\u003EIf a complaint is from a young person you should respond in plain, clear language they can understand.\u003C/p\u003E\n\u003Cp\u003E\u003Cstrong\u003E5. Learn from complaints\u003C/strong\u003E\u003Cbr\u003EComplaints are an opportunity to improve. After closing a complaint, you should look to see if there is any learning to be had from it. This might include updating processes or policies, providing further training or reminding volunteers about best practice. Learning should be recorded in your complaint log.\u003C/p\u003E\n\u003Cp\u003EFurther guidance on managing data protection complaints \u003Ca href=\u0022https://ico.org.uk/for-organisations/how-to-deal-with-data-protection-complaints/\u0022\u003Ecan be found on the ICO website\u003C/a\u003E.\u003C/p\u003E","gtmId":"","gtmClass":""}]}],"config":null}]},"prev":{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-12-responding-to-a-breach/","title":"Step 12: Responding to a breach"},"next":null,"allParts":[{"link":"/volunteers/running-things-locally/gdpr-toolkit/introduction/","title":"Introduction"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-1-what-do-i-need-to-know-about-data-protection/","title":"Step 1: What do I need to know about data protection?"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-2-who-is-responsible-for-what/","title":"Step 2: Who is responsible for what?"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-3-appointing-a-data-lead/","title":"Step 3: Appointing a Data Lead"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-4-understanding-data-subjects-rights/","title":"Step 4: Understanding data subjects\u0027 rights"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-5-gathering-data/","title":"Step 5: Gathering data"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-6-data-discovery/","title":"Step 6: Data discovery"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-7-keep-a-record/","title":"Step 7: Keep a record"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-8-check-your-security/","title":"Step 8: Check your security"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-9-third-parties/","title":"Step 9: Third parties"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-10-publish-your-privacy-stance/","title":"Step 10: Publish your privacy stance"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-11-delete-and-destroy/","title":"Step 11: Delete and destroy"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-12-responding-to-a-breach/","title":"Step 12: Responding to a breach"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-13-have-a-complaints-process/","title":"Step 13: Have a Complaints Process"}],"link":"/volunteers/running-things-locally/gdpr-toolkit/step-13-have-a-complaints-process/","id":89282,"nodeName":"Step 13: Have a Complaints Process","title":"Step 13: Have a Complaints Process","type":"codexPart","image":null,"assets":null,"headerOptions":{"headerTitle":"Step 13: Have a Complaints Process","headerSubTitle":null,"headerCta":null,"headerCtaText":null,"headerCtaLink":null,"headerBackgroundColour":null,"showSEOImage":false,"headerBackgroundImage":null,"quickLinks":null},"searchDescription":"","subHeader":"","browserTitle":null,"silktide":"eyJjbXMiOiJVbWJyYWNvIiwiZWRpdG9yVXJsIjoiaHR0cHM6Ly9wcm9kLWNtcy5zY291dHMub3JnLnVrLy91bWJyYWNvIy9jb250ZW50L2NvbnRlbnQvZWRpdC84OTI4MiJ9","canonicalUrl":"https://www.scouts.org.uk/volunteers/running-things-locally/gdpr-toolkit/step-13-have-a-complaints-process/"}