Data Protection Complaints Procedure
Solico London Limited

How to make a complaint about how we handle your personal data, and how we will deal with it. This procedure meets the requirements of section 164A of the Data Protection Act 2018, introduced by the Data (Use and Access) Act 2025, which apply from 19 June 2026.

1. Purpose

Solico London Limited ("Solico", "we", "us") is committed to handling personal data lawfully, fairly and transparently. If you are unhappy with how we have collected or used your personal data, you have the right to complain to us directly.

This procedure explains how you can make a data protection complaint, what will happen once we receive it, and the timescales we work to. It also sets out how we record and learn from complaints. It applies in addition to your existing right to complain to the Information Commissioner's Office (the ICO).

2. Scope and who this applies to

This procedure applies to any complaint about the way Solico has handled personal data where we are acting as the data controller, that is, where we decide how and why personal data is processed.

Anyone can make a data protection complaint, including clients, members of the public, programme participants, suppliers, contractors and staff. You can complain about your own personal data, or about personal data you are handling on behalf of someone else where you are authorised to do so.

3. What counts as a data protection complaint

A data protection complaint is any expression of dissatisfaction about how we have handled personal data and how that may have infringed data protection law. You do not need to use legal language, quote legislation, or use the word "complaint" for it to count.

Examples of matters that may be data protection complaints:

  • how we have collected, used, shared or stored personal data

  • how we have responded to a request to access, correct, delete or restrict personal data

  • direct marketing, cookies or other tracking, where personal data is involved

  • how long we keep personal data, or our transparency about what we do with it

  • a personal data breach, or the security measures applied to personal data

  • the lawful basis we have relied on for processing personal data

Please note. Not every complaint is a data protection complaint. A complaint about the quality of our services, for example, is handled under our general complaints process. Where a complaint involves both a data protection issue and another matter, we will deal with the data protection element under this procedure.

4. How to make a complaint to us

You can make a data protection complaint in any of the following ways. You do not have to use the complaint form, but using it helps us deal with your complaint quickly because it captures the information we need.

Online form Complete our data protection complaint form online at https://www.solico.org.uk/data-complaint
Emailprivacy@solico.org.uk
Post Data Protection, Solico London Limited, 167-169 Great Portland Street, 5th Floor, London W1W 5PF

You can also raise a data protection complaint with any member of Solico through any channel you normally use to contact us. However you reach us, we will make sure your complaint is passed to the right person and handled under this procedure.

To help us deal with your complaint, please tell us:

  • your name and how you would like us to contact you

  • what your complaint is about, with relevant dates and details

  • what you would like us to do to put things right, if you have a view

5. Complaints made on behalf of someone else

If you are making a complaint on behalf of another person, we may ask you to confirm that you are authorised to act for them before we investigate, so that we protect that person's personal data.

Where a complaint concerns a child, we will consider whether the child is able to make the complaint themselves, and we will make sure any communication is clear and appropriate to their age and understanding.

6. What happens when we receive your complaint

We will deal with your complaint in the following stages.

6.1 Acknowledgement

We will acknowledge your complaint within 30 days of receiving it. The 30 days begin the day after we receive your complaint. If the final day falls on a weekend or public holiday, we will acknowledge it by the next working day.

Our acknowledgement will confirm that we have received your complaint and explain what will happen next. Where you contact us electronically, we may acknowledge your complaint using an automated reply.

6.2 Investigation

We begin looking into your complaint as soon as we receive it, we do not wait until we have sent the acknowledgement. We will make appropriate enquiries, which may include reviewing our records and speaking to the people involved. How long this takes will depend on the nature of the complaint, but we will not allow unjustifiable or excessive delay.

If we need more time, or more information from you, we will keep you updated on progress and let you know what to expect.

6.3 Outcome

Once we have completed our investigation, we will tell you the outcome without undue delay. We will explain what we found, the steps we have taken, and any action we will take as a result. We will provide this in a format that is accessible to you.

If we are not able to resolve your complaint to your satisfaction, we will tell you about your right to complain to the ICO and how to do so (see section 9).

7. How we record complaints

We keep a record of every data protection complaint so that we can manage it properly, demonstrate that we have met our obligations, and identify any recurring issues. For each complaint we record the date it was received, the date we acknowledged it, the steps we took to investigate, the outcome, and any action taken as a result. The fields we use are listed at the end of this procedure.

After a complaint is resolved, we consider what we can learn from it to help prevent similar issues in future.

8. Responsibilities within Solico

Everyone working for or with Solico, including associates and contractors, is responsible for recognising a possible data protection complaint and passing it without delay to the person responsible for data protection. The Director of Solico is responsible for operating this procedure, meeting the timescales, keeping records, and overseeing any action needed as a result of a complaint.

9. Complaining to the Information Commissioner's Office

We would always encourage you to raise your concern with us first so that we have the chance to put things right. You can, however, complain to the ICO at any time. The ICO is the UK's independent regulator for data protection.

By post Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Helpline 0303 123 1113
Onlinewww.ico.org.uk/make-a-complaint

10. Legal basis for this procedure

This procedure reflects section 164A of the Data Protection Act 2018, inserted by section 103 of the Data (Use and Access) Act 2025, which requires data controllers to facilitate the making of data protection complaints and to acknowledge, investigate and respond to them. It sits alongside the UK GDPR and the Data Protection Act 2018, which continue to apply in full.

The details we record

We record the following details for each data protection complaint to manage it and to demonstrate compliance.

  • Unique reference number

  • Date complaint received and the channel it came through

  • Complainant's name and contact details (and authority to act, if on behalf of another)

  • Summary of the complaint

  • Date acknowledgement sent

  • Investigation steps, enquiries made and any updates given to the complainant

  • Outcome and the reasons for it

  • Any action taken as a result, and lessons learned

  • Date the outcome was communicated and whether the complainant was signposted to the ICO