1. Policy Statement
Notebook & Pen is committed to protecting personal data and respecting the rights of individuals under UK data protection legislation, including the UK GDPR, the Data Protection Act 2018 and the Data (Use and Access) Act 2025. We recognise the right of individuals to raise concerns about how we collect, use, store, share or otherwise process their personal data. We are committed to handling all data protection complaints fairly, promptly and transparently. This policy explains how individuals can make a data protection complaint and how Notebook & Pen will manage, investigate and respond to those complaints.
2. Scope
This policy applies to:
- Clients
- Website users
- Suppliers and contractors
- Current and former employees, workers and associates
- Any individual whose personal data is processed by Notebook & Pen
3. What is a Data Protection Complaint?
A data protection complaint is any expression of dissatisfaction or concern relating to the way Notebook & Pen processes personal data.
Examples include:
- Failure to respond appropriately to a Subject Access Request (SAR)
- Delays in responding to data protection rights requests
- Personal information being disclosed incorrectly
- Personal data being inaccurate and not corrected
- Personal data being retained for longer than necessary
- Concerns about consent or lawful processing
- Concerns arising from a personal data breach
- Failure to delete personal data when appropriate
The complaint does not need to refer to data protection legislation or use specific wording. Complaints may be received verbally or in writing.
4. Matters Not Covered by this Policy
The following will normally be dealt with under separate procedures:
- General customer service complaints
- Complaints about training content or course delivery
- Commercial disputes
- Employment grievances
- Disciplinary matters
- Whistleblowing concerns
Where a complaint contains both data protection and non-data protection issues, the data protection elements will be handled under this policy. Where a complaint falls outside the scope of this policy, Notebook & Pen will notify the complainant and advise them of the appropriate route for raising their concern. Notebook & Pen reserves the right not to investigate a complaint that is manifestly unfounded or vexatious, or that duplicates a matter which has already been fully investigated and concluded. Where we decline to investigate on this basis, we will notify the complainant and explain our reasons.
5. How to Make a Complaint
Individuals may submit a data protection complaint by email – info@notebookandpen.co.uk
To help us investigate, complainants should provide:
- Their name and contact details
- Details of the concern
- Relevant dates
- Any supporting evidence
Complaints should normally be raised within 12 months of the matter coming to the individual’s attention. We will consider complaints submitted after this period where there is good reason to do so, but our ability to investigate may be limited by the availability of relevant records. However, a complaint will not be rejected simply because limited information is provided.
Where there is reasonable doubt about the identity of a complainant, Notebook & Pen may request proof of identity before proceeding with the investigation. Acceptable evidence may include photographic ID or another appropriate form of verification. Where a complaint is submitted on behalf of another individual, for example by a solicitor, family member or other representative, Notebook & Pen will require evidence that the representative is authorised to act on that person’s behalf. Acceptable evidence may include a signed letter of authority from the data subject or a relevant legal instrument such as a power of attorney. This policy should be read alongside Notebook & Pen’s Privacy Notice. Where a complaint relates to a Subject Access Request or a personal data breach, it will be handled in accordance with our data protection obligations under the UK GDPR and the Data (Use and Access) Act 2025.
6. Complaint Handling Process
Stage 1 – Acknowledgement
Notebook & Pen will acknowledge receipt of a data protection complaint within 30 calendar days of receiving it. The 30-day period begins the day the complaint is received. If the final day falls on a weekend or public holiday, acknowledgement may be given on the next working day.
The acknowledgement will:
- Confirm receipt of the complaint
- Provide a unique complaint reference number
- Identify the person responsible for handling it
- Explain the next steps
- Provide an indicative timescale
Stage 2 – Investigation
We will investigate complaints without undue delay.
The investigation may include:
- Reviewing relevant records and systems
- Speaking with staff involved
- Reviewing correspondence
- Seeking clarification from the complainant where necessary
- Assessing compliance with applicable data protection legislation
We will keep the complainant informed of progress where appropriate.
Stage 3 – Outcome
We aim to provide a full response within three months of receiving the complaint.
Our response will:
- Summarise the complaint
- Explain the findings of the investigation
- Confirm any actions taken or proposed
- State whether the complaint is upheld, partially upheld or not upheld
- Explain any remedial measures implemented
- Advise the complainant of their right to contact the Information Commissioner’s Office (ICO)
Where additional time is required due to complexity, we will keep the complainant informed.
7. Escalation to the ICO
If an individual remains dissatisfied after receiving our final response, they have the right to contact the Information Commissioner’s Office (ICO). Information about raising concerns with the ICO can be found via the ICO website. Notebook & Pen encourages individuals to allow us the opportunity to resolve concerns before approaching the ICO.
8. Record Keeping
Notebook & Pen will maintain a Data Protection Complaints Register containing:
- Complaint reference number
- Date received
- Complainant name
- Nature of complaint
- Date acknowledged
- Investigation actions taken
- Outcome
- Date closed
- Any lessons learned or corrective actions
Records will be retained in accordance with our data retention arrangements and will be stored securely.
9. Roles and Responsibilities
Data Protection Lead
The Data Protection Lead is responsible for:
- Receiving and managing complaints
- Conducting investigations
- Maintaining complaint records
- Issuing responses
- Monitoring trends and lessons learned
- Updating procedures where necessary
All Staff and Associates
All staff and associates will:
- Recognise potential data protection complaints
- Forward complaints promptly to the Data Protection Lead
- Cooperate with investigations
- Maintain confidentiality throughout the process
10. Complaints Involving Third Parties
Where Notebook & Pen acts as a data processor on behalf of another organisation, any data protection complaint relating to that processing will be referred promptly to the relevant data controller in accordance with contractual obligations. We will cooperate with the controller in investigating and resolving the matter.
11. Monitoring and Review
This policy will be reviewed annually or sooner if:
- Legislation changes
- ICO guidance changes
- Operational requirements change
- Significant complaints indicate a need for improvement
Document Control
Version: 1.0
Approval Date: June 2026
Review Date: June 2027