UKI want to complain about a data protection breach. Where do I go?
You should complain to the Information Commissioner’s Office (ICO), the UK’s independent data protection regulator, which has the power to investigate and take action on data protection breaches.
What the Law Says
The Data Protection Act 2018 gives the Information Commissioner the legal authority to handle complaints about how organisations handle personal data.
Under section 165 of the Data Protection Act 2018, the Information Commissioner must consider complaints from individuals who believe their data protection rights have been breached. The Commissioner can investigate, require organisations to provide information, issue enforcement notices, and impose fines where appropriate.
You do not need to go through the organisation first — you can complain directly to the ICO. However, it helps if you’ve already raised the issue with the organisation and kept records of your attempts.
Statutory TextThe Information Commissioner must, on receipt of a complaint made by an individual under this section, consider the complaint.
— Data Protection Act 2018, s. 165 — Complaints by individuals
What to Do
Gather evidence: keep copies of emails, messages, or documents showing the breach and any communication with the organisation.
Submit your complaint online at ico.org.uk/make-a-complaint — it’s free and usually takes under 10 minutes.
The ICO aims to respond within 40 days, though complex cases may take longer.
If unsatisfied with the ICO’s decision, you can apply to the First-tier Tribunal (Information Rights) for a review.
Sources
Same Question, Other Jurisdictions
Ireland
Singapore
European Union
South Korea
JapanNot legal advice. This article is general information based on publicly available sources, written for educational purposes. Laws change and individual situations vary. Consult a licensed attorney in your jurisdiction before acting on anything you read here. Last reviewed: 2026-06-08.