Skip to main content

{{ root_page.title }}

Information complaints policy

1. Introduction

The UK General Data Protection Regulation ('UK GDPR'), the Data Protection Act 2018 ('DPA 2018'), and the Data Use and Access Act 2025 (together, the 'Data Protection legislation'), give data subjects and applicable third parties rights in relation to personal data. This procedure details how Achieving for Children (AfC) will respond to complaints from data subjects and third parties relating to the use of personal data.

AfC is committed to delivering a consistently high-quality service. However, AfC acknowledges that individuals, service users, children and young people, employees, or other third parties may occasionally have concerns or wish to raise issues related to data protection. 

The purpose of this policy is to provide a clear framework of how AfC will respond and learn from the information complaints it receives.

2. Scope 

This policy applies to complaints made by a member of the public or body acting on behalf of a data subject who has a complaint about an information governance or data protection related matter. 

Complaints may be made in relation to any aspect of AfC’s processing of personal data, including:

  • complaints about how personal data has been handled including data breaches
  • handling of individual rights requests
  • complaints relating to the content of AfC privacy notices
  • complaints relating to any data sharing with third parties 

This policy does not deal with internal reviews requested for Freedom of Information (FOI) responses, the process for FOI responses is detailed here.

3. What is an information complaint?

An information complaint refers to an expression of dissatisfaction with how AfC has handled your personal data in response to customer's rights under the UK GDPR and Data Protection Act 2018. A complaint about personal data handling may also be reporting a personal data breach.

An information complaint is not:

  • an initial request to access information held by Achieving for Children
  • an enquiry about the process for dealing with a specific issue
  • a complaint about a service or the behaviour of staff. Such complaints will be managed under the corporate complaints procedure; refer to our concerns and complaints page for further details

4. Complaints procedure

4.1 How to make an information complaint 

Those who wish to complain should be encouraged to do so as soon as possible after an event so that the investigation can be most effective by contacting the Data Protection Officer in writing by email: [email protected] or post to:  

Achieving for Children 
44 York Street
Twickenham 
TW1 3BZ

Where a complaint is received from a third party on behalf of another, the data subject must confirm in writing that they have given their authority to do so. This will require a signed authority, coupled with two forms of identification. This must take place prior to the disclosure of any personal data to the third party. 

Unless there are extenuating circumstances, complaints made more than 40 days after the response will not be considered.

Complaints made outside this timescale, will be reviewed by the Data Protection Officer for a decision on whether or not the complaint will be investigated.

Complaint response timescales are:

  • Stage one: 20 working days
  • Stage two: 10 working days

4.2 Stage one complaints  

The complaint will be logged and acknowledged promptly and within two working days of receipt of the complaint, and the customer informed of the deadline for responding to the complaint.

The timescale for responding to information complaints is 20 working days. 

All information complaints will be dealt with courteously, openly and fairly.   

4.3 Stage one   

Upheld or partially upheld

Where we have made a mistake or failed to provide the expected standard or quality of service, we will acknowledge and apologise for this. We will also set out the actions we will take to put things right and improve our services. This could include:

  • providing previously withheld information
  • reviewing our information governance policies and procedures
  • reviewing how we handle personal data
  • providing appropriate staff training and guidance

Not upheld

Where we have investigated and we still uphold the original decision, we will:

  • explain the reasons for our decision clearly
  • provide any relevant evidence to support the decision
  • advise customers of their right of appeal if they remain dissatisfied

4.4 Stage two  

If the customer is not satisfied with the stage one complaint response, the customer can ask for their complaint and response to be reviewed at stage two of the information complaints procedure. 

The stage two complaint will be acknowledged within two working days.

The timescale for responding to the stage two complaint is 10 working days.

The Associate Director for Strategy and Transformation who is also the designated Senior Information Risk Officer (SIRO) will conduct a review of the investigation at stage one to determine whether the decision was fair and the complaint responded in full. The stage two investigation does not reopen the investigation, but reviews whether the review at stage one was conducted in the right way.

4.5 Final stage 

If the customer is still not satisfied, they have the right to appeal to the Information Commissioner by writing to them at:  

Information Commissioner’s Office 
Wycliffe House, Water Lane
Wilmslow
Cheshire
SK9 5AF

5. Persistent and vexatious information complaints

We aim to respond to all information complaints professionally and in a courteous and timely manner, ensuring that customers are satisfied with the way their complaint has been handled. 

AfC’s employee guidance for managing unacceptable customer behaviour provides a clear framework about expected behaviours and standards.  

In a small number of cases, customers may pursue a complaint in an unreasonable way, which impacts on AfC resources and capacity to respond to the complaint effectively. A customer may be considered to be unreasonably persistent or vexatious in pursuing their information complaint if they:

  • change the basis of a complaint during the investigation process
  • refuse to cooperate with the complaints investigation process
  • refuse to accept investigation conclusions and decisions

Continuing to respond to these complaints can take up a lot of time and reduce capacity to deal with other complaints effectively.

Where it is considered that an information complaint has become vexatious, the Data Protection Officer, with legal advice if necessary, will inform the customer of any decision to close a complaint and not enter into any further correspondence on the matter. 

6. Learning from information complaints

Information complaints offer an opportunity to learn and improve. When the investigation of a complaint identifies that changes in practice are required, the Data Protection Officer will work with the relevant service area to ensure these are carefully considered and implemented as soon as is practically possible. 

All trends and themes identified will be reported through the Information Governance and Security Board on an anonymised level to enable organisational learning. 

AfC is committed to listening to the views of the public and welcomes feedback to allow for the improvement of its services.

7. Useful contacts

Policy review date: August 2025