Use this as a standalone data protection complaints process, or add it as a named section inside your existing complaints policy.
| Step | Record |
|---|---|
| Receive | Date received, person complaining, contact details, issue raised, data or system involved. |
| Acknowledge | Acknowledge within 30 days. Record date, method, and owner. |
| Investigate | Search relevant systems, documents, messages, records, supplier tools, and staff notes. |
| Update | Keep the complainant informed where appropriate, especially if more time or information is needed. |
| Outcome | Explain what was found, what action was taken, and what the complainant can do if still unhappy. |
| Close | Record final outcome, date closed, and any changes to documents, suppliers, security, or training. |