Adopted: 21 September 2026  |  Review Date: September 2027

This data protection complaints policy sets out the procedures we have put in place to deal with any complaint regarding the usage of a data subjects personal data within our organisation or our response to a request made by a data subject under the data protection legislation. 

We are Perranzabuloe Parish Council a council in England.  Our contact details are Perranzabuloe Parish Council, Chyanhale, Ponsmere Valley, Perranporth, TR6 0DB, email: clerk@perranzabuloe-pc.gov.uk 

We are a data controller for personal data as defined by all applicable data protection and privacy laws including, but not limited to, the retained EU law version of the General Data Protection Regulation ((EU) 2016/679) (the “UK GDPR”), as it forms part of the law of England and Wales, Scotland, and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018, the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 as amended, and any successor legislation (the “Data Protection Legislation”). 

This policy is binding on all employees, members and volunteers (“User” or “Users”) of Perranzabuloe Parish Council (“The Organisation”) 

  1. Definitions
    1.1 “Personal data” means any information relating to an identified or identifiable individual (“data subject”); an identifiable individual is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that individual.
    1.2 “Complain” or “complaints” means any complaint made in connection with personal data relating to the data subject, where there is an allegation of an infringement of the UK GDPR or Part 3 the Data Protection Act 2018.
    1.3 “Complainant” means a data subject who is making a complaint about the organisations usage of a their personal data, or a complaint about the organisations response to a request made under the data protection legislation.
  2.  Who is responsible for managing data protection complaints.
    2.1 The Parish Clerk is responsible for the ongoing compliance monitoring of this and other policies that are designed to achieve compliance with the Data Protection Legislation.  (“the person responsible for data protection”). 
    2.2 No user within the organisation shall deviate from this policy without written authorisation from the person responsible for data protection.
  3. Time Limits
    3.1 When a complaint is received the person responsible for data protection must acknowledge receipt of the complaint within the period of 30 days beginning when the complaint is received.
    3.2 When a complaint is received the person responsible for data protection must investigate and respond without unjustifiable or excessive delay.
           3.2.1 The organisation aims to investigate and respond to data protection complaints within 30 days but may require extra time if it is justifiable.
    3.2.2     If extra time is justifiable the person responsible for data protection will inform the complainant within 30 days beginning when the complaint is received, together with justification for the delay. 
  4. What are data protection complaints?
    4.1 Valid data protection complaints:
          4.1.1 A data protection complaint is a complaint where a data subject considers that there has been an infringement of data protection legislation due to the organisations handling of their personal data.
             4.1.1.1 Examples include but are not limited to:
             4.1.1.2 Complaints about a response to a subject access request, or other rights request
             4.1.1.3  Complaints regarding security of data subjects personal data when it is processed by the organisation
            4.1.1.4  Complaints by a data subject impacted by a data breach
            4.1.1.5 Complaints by a data subject regarding the organizations collection or use of their personal data
            4.1.1.6 Complaints by a data subject regarding the organisations retention of their personal data
    4.2 Valid data protection complaints:
    4.2.1 Not all complaints that have processing of personal data referenced within them fall under this policy.  For example, if an employee raises a grievance issue, and also request copies of their personal information, or a person complains about the councils service, and at the same time requests that the organisation deletes their personal data.  
    4.2.2 If the person responsible for data protection is unsure if a complaint falls under this policy or is a general complaint, they should ask the complainant to clarify if they are making a data protection compliant.
    4.2.3 If the complaint is regarding a response to a Freedom of Information Request then it should be handled under the internal review procedures as laid out in the Freedom of Information Act 2000 section 45 code of practice. 
    4.3  A data protection complaint cannot be made on behalf of a third party unless the complainant has:
         4.3.1 an appropriate power of attorney; or
         4.3.2 a signed letter of authority from the person they are acting on behalf of. 
    4.4 If a complaint is deemed not to be a valid data protection complaint it will be dealt with under other appropriate law, codes of conduct, policies or procedures.
    The full policy is available to view and download.