Data‑Protection Complaints

If you’re unhappy with how we’ve handled your personal data, you can raise a data‑protection complaint at any time. We will acknowledge your complaint within 30 days and respond without undue delay, keeping you informed throughout.

You can contact us at:

Email: helpme@bridgerslaw.co.uk

Telephone: 01795 505 992

If you’re not satisfied with our response, you can escalate your concern to the Information Commissioner’s Office (ICO). The ICO normally expects you to contact us first.

Bridger’s Law Ltd Data Protection Complaints Policy and Procedure

In terms of the Data (Use and Access) Act 2025 and ICO guidance)

1. Purpose

This policy establishes the organisation’s formal process for receiving, acknowledging, investigating, and resolving data‑protection complaints. It ensures compliance with the UK GDPR, Data Protection Act 2018, PECR, and the Data (Use and Access) Act 2025, which requires all controllers to maintain and operate a publicly accessible complaints process.

2. Scope

This policy applies to:

• All data‑protection complaints raised by any individual whose personal data we process.
• Where the client is a Company, to any individual connected with the company whose personal data we process.
• All staff, contractors, and representatives handling such complaints.
• All processing activities where we act as a controller.

3. What Individuals Can Complain About

A data‑protection complaint includes concerns relating to:

• A personal‑data breach affecting them.
• Our response to a DSAR or other rights request.
• Retention periods or deletion practices.
• Accuracy of personal data.
• Security measures.
• Profiling, automated decision‑making, or AI‑driven processing.

4. What Is Not a Data‑Protection Complaint

The following are out of scope unless they include a specific data‑protection concern:

• General service complaints.
• HR grievances.
• Dissatisfaction with the speed of a DSAR we responded to on time.
• Customer‑service issues accompanied by a privacy request.

5. How Individuals Can Complain

We accept complaints via:

• Email
• Online form or portal
• Postal address
• Any informal communication (comments, messages, verbal statements) that reasonably indicates a concern about personal‑data handling. Individuals are not required to use a specific form.

6. Acknowledgement

We will acknowledge every complaint within 30 days of receipt, as required by the DUAA.

7. Investigation Process

We will:

• Assess and clarify the complaint where needed.
• Make appropriate enquiries and gather evidence.
• Keep the complainant updated on progress.
• Take steps without undue delay, in line with statutory expectations.

8. Outcome

We will provide a final outcome promptly, explaining:

• How the investigation was carried out.
• What information was considered.
• Our conclusion and reasoning. The ICO may scrutinise our handling if the individual escalates.

9. Escalation to the ICO

Individuals may escalate their concern to the ICO after using our internal process. The ICO expects organisations to resolve complaints directly wherever possible.

10. Record‑Keeping

We maintain a full audit trail of:

• Complaints received
• Steps taken
• Communications
• Outcomes This supports regulatory accountability.

11. Responsibilities

• DPO / Compliance Lead: Oversight, reporting, and quality assurance.
• All Staff: Duty to recognise and escalate potential complaints immediately.