Data Protection Complaints Procedure

Introduction

This procedure explains how individuals can make a complaint about the way St Pauls Chambers has handled their personal data, what information we may need to investigate the complaint, and when they can expect a response.

St Pauls Chambers is committed to handling personal data lawfully, fairly, securely and transparently. This procedure provides a clear route for individuals to raise data protection complaints with us.

St Pauls Chambers is required to have a data protection complaints procedure as set out in the Data (Use and Access) Act 2025, which amended the UK GDPR and the Data Protection Act 2018. This requirement came into force on 19 June 2026.

When to use this procedure

This procedure should be used where an individual has a Data Protection Complaint (DPC) and believes that St Pauls Chambers may have infringed data protection legislation in the way we have collected, used, stored, shared, retained, protected, or otherwise handled their personal data, or the personal data of someone they are authorised to act for.

What this procedure covers

How St Pauls Chambers responded to a request made under the Data Protection Act 2018, including requests for access, rectification, erasure, restriction, objection, portability, or other applicable data protection rights.

Concerns about the security measures used to protect personal data, including concerns arising from an actual or suspected data breach.

How St Pauls Chambers collected, used, shared, stored, retained, or deleted personal data.

Concerns about the accuracy of personal data St Pauls Chambers holds.

Any other matter relating to St Pauls Chambers’ compliance with data protection legislation.

Making a complaint – Time limits

St Pauls Chambers will only consider a DPC received within six months of the matter complained about. Complaints received outside this period will only be considered in exceptional circumstances, for example where the complainant became aware of the matter more than six months after it occurred.

How to Make a Data Protection Complaint

A DPC can be made by email to our Senior Clerk, Jayne Drake [email protected] , or in writing addressed to:

Jayne Drake
St Pauls Chambers
Park Row House,

19-20 Park Row

Leeds

LS1 5JF

Please provide as much detail as possible so that we can understand and investigate the complaint. This should include your name and contact details, a description of the issue, relevant dates, copies of correspondence, reference numbers, the personal data involved, and the outcome sought.

Supporting information required to investigate a complaint

St Pauls Chambers may need to ask someone who has made a complaint for proof of identity before we can proceed.

A DPC may be made by someone acting on behalf of another person. St Pauls Chambers may require evidence of authority to act.

In the absence of appropriate evidence, St Pauls Chambers will not investigate the complaint.

Acknowledgement and Investigation

St Pauls Chambers will aim to acknowledge receipt of a DPC within 5 working days.

We will aim to investigate and provide an outcome within one calendar month. Complex complaints may take longer to resolve.

Where necessary, St Pauls Chambers will request additional information or clarification.

We will keep the complainant updated on the progress of the investigation where possible.

Outcome and possible remedies

We will provide the complainant with the outcome of the DPC without undue delay once the investigation is complete.

Where a DPC is upheld, possible actions may include correcting inaccurate data, completing or revisiting a data protection request, improving security measures, changing internal processes, providing further explanation, offering an apology, updating records, or taking other appropriate remedial action.

Escalation to the Information Commissioner’s Office

If the complainant remains dissatisfied after receiving our response, or believes St Pauls Chambers has not handled the original DPC appropriately, they may raise the matter with the Information Commissioner’s Office (ICO).

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow, Cheshire
SK9 5AF

Website: https://ico.org.uk/make-a-complaint/
Telephone: +44 (0) 303 123 1113

Record Keeping and Learning

We will keep appropriate records of each DPC and use complaints to identify lessons learned, improve our handling of personal data, and strengthen data protection governance.

Review of this Procedure

This procedure will be reviewed periodically and updated where required to reflect changes in data protection law, regulatory guidance, organisational structure, or operational practice.

19 June 2026