Complaints Policy (Data Protection and Information Rights)

Complaints Policy (Data Protection and Information Rights)

Compliant with the UK Data Protection Framework, including the Data (Use and Access) Act (DUAA), UK GDPR, Data Protection Act 2018, and ICO guidance

1. Purpose

This procedure sets out how 174 Family Law receives, investigates and responds to complaints about how the firm handles personal data, in line with the UK GDPR and the Data Protection Act 2018.

This Complaints Policy establishes a fair, transparent, and effective process for handling complaints relating to:

  • Personal data processing;
  • Data subject rights requests;
  • Privacy and confidentiality concerns;
  • Information governance matters;
  • Data sharing and access issues;
  • Automated decision-making concerns;
  • Direct marketing complaints;
  • Any matter falling within the scope of the Data (Use and Access) Act (DUAA), UK GDPR, Data Protection Act 2018, and associated regulations.

The organisation is committed to investigating complaints promptly and providing clear outcomes while ensuring compliance with guidance issued by the UK’s Information Commissioner’s Office.

This procedure does not cover complaints about the standard of legal advice or service, which are handled under the firm’s separate client complaints procedure and, if unresolved, may be referred to the Legal Ombudsman. Where a complaint raises both a service issue and a data protection issue, both procedures are followed and the complainant is told how each strand will be handled.

2. Scope

This policy applies to:

  • Clients
  • Service users
  • Employees
  • Contractors
  • Volunteers
  • Suppliers
  • Data subjects
  • Representatives acting on behalf of data subjects

3. Legal framework

This policy is informed by:

  • Data (Use and Access) Act
  • UK General Data Protection Regulation
  • Data Protection Act 2018
  • Information Commissioner’s Office guidance
  • Privacy and Electronic Communications Regulations (PECR) where applicable

For further regulatory guidance, refer to: ICO Complaints Guidance

4. Principles

All complaints will be handled:

  • Fairly
  • Impartially
  • Confidentially
  • Without retaliation
  • Within statutory timescales
  • With appropriate records maintained

We will:

  • Acknowledge complaints promptly.
  • Investigate proportionately.
  • Keep you informed.
  • Give reasons for our decisions.
  • Explain your rights to escalate.

5. What counts as a data protection complaint

Typical examples include a concern that:

  • personal data has been collected, used or shared unfairly, unlawfully, or beyond what the person was told
  • personal data is inaccurate, excessive, kept for longer than necessary, or has been disclosed to the wrong recipient
  • personal data has not been kept secure (including a suspected data breach)
  • a subject access request, or a request to rectify, erase, restrict or object to processing, was refused, ignored, or not actioned within the statutory timescale
  • marketing or other communications were sent without a lawful basis or after an opt-out

6. How to make a complaint

You can make a complaint:

  • By email
  • By post
  • In person
  • Through an authorised representative

Contact Helen Pittard, Director:

If your complaint is about Helen, contact Melissa Quayle at mquayle@174familylaw.co.uk instead.

To help us investigate, please tell us:

  • your name and contact details (and your representative’s details and authority, if someone is complaining on your behalf)
  • what your complaint is about
  • when the issue happened, and when you first told us about it
  • what you would like us to do to put things right

Please include copies of any relevant emails, letters, screenshots or other evidence.

7. Complaints procedure

Stage 1 – Receipt, log and acknowledgement

When we receive your complaint, we will record it in our complaints register and check whether:

  • we need to verify your identity;
  • we need any further information from you;
  • the complaint concerns personal data.

Timescale: we will acknowledge your complaint within 5 working days.

Stage 2 – Investigation

The person investigating your complaint will:

  • review the relevant records;
  • speak to the staff involved;
  • consider the applicable law and our compliance obligations;
  • consider any risks to you or others.

Where necessary, we will consult our Data Protection Officer (DPO).

Investigation period: we normally complete our investigation within 30 calendar days.

If your complaint is complex and we need longer, we will tell you, and explain why.

If we reasonably need more information, or need to verify your identity, before we can investigate, we may pause the timescale until we receive it. If so, we will tell you:

  • what information we need;
  • why we need it;
  • how this affects the timetable.
Stage 3 – Outcome

We will write to you with our response, including:

  • a summary of your complaint;
  • our findings;
  • any actions we have taken;
  • any steps we are taking to put things right;
  • your right to escalate your complaint;
  • where appropriate, any lessons learned and changes we have made.

The outcome will be one of the following:

  • your complaint is upheld;
  • your complaint is partially upheld;
  • your complaint is not upheld;
  • an informal resolution is agreed with you.
Stage 4 – Escalation

If you are not satisfied with our decision, you can ask for an internal review within 30 days of the decision.

A senior member of the firm who has not been involved in your complaint will carry out the review.

Stage 5 – ICO referral

If you remain dissatisfied, you can contact the Information Commissioner’s Office (ICO): ICO official website.

Our final response letter will explain how to contact the ICO. Referring your complaint to the ICO does not affect your other legal rights, including the right to seek a judicial remedy or compensation through the courts.

8. Record keeping

We log every data protection complaint on our complaints register. This records the date received, who made the complaint, the nature of the complaint, any matter or file reference, who investigated it, key dates (acknowledged, extended, responded), the outcome, and any action we took as a result.

We keep these records in line with our retention schedule.

9. Policy review

This procedure is reviewed annually by the Managing Director as part of the firm’s Lexcel compliance review cycle, or sooner if a complaint, breach, or change in law or ICO guidance shows it needs updating. Changes are approved by the Board of Directors before the revised version takes effect.

Version 1.0, 09/06/2026. Next review date: December 2027.