Until the Getting Started Wizard is live, use this guide to identify the information your firm needs to provide. When an option is presented, copy the option that applies and paste it into the policy, replacing the bracketed placeholder.
At a glance
Total customisation points: 12
Personalised fields (firm-specific text to insert): 12
Applicability toggles (choose which option applies): 0
Section: About this procedure / 2.1 Data Protection Officer
[DPO] — Personalised Field (cross-policy)
Question: Who is the firm's Data Protection Officer (DPO)?
Guidance: Insert the name of the firm's DPO. The DPO has overall responsibility for data protection compliance, including oversight of the data protection complaints procedure.
[deputy DPO] — Personalised Field (cross-policy)
Question: Who is the firm's deputy DPO?
Guidance: Insert the name of the deputy DPO. This person acts in the DPO's absence for data protection decisions and complaint handling.
Section 1 — Purpose and scope / 3.1 How to make a complaint
[firm name] — Personalised Field (cross-policy)
Question: What is the firm's name?
Guidance: Insert the full legal name of the firm as registered with the SRA.
Section 2.2 — Complaints coordinator / 3.2–3.6
[complaints coordinator] — Personalised Field
Question: Who is the firm's data protection complaints coordinator?
Guidance: Insert the name and contact details of the person who manages the day-to-day data protection complaints process, including logging, acknowledging, tracking and allocating complaints.
Section 3.1 — How to make a complaint
[firm address] — Personalised Field (cross-policy)
Question: What is the firm's postal address?
Guidance: Insert the firm's main postal address. Used in the postal complaints channel.
[firm telephone] — Personalised Field (cross-policy)
Question: What is the firm's main telephone number?
Guidance: Insert the firm's main telephone number. Complaints made by telephone must be followed up in writing.
[DP complaints email] — Personalised Field
Question: What is the firm's dedicated email address for data protection complaints?
Guidance: Insert the email address where individuals can submit data protection complaints. This must be communicated in the firm's privacy notice.
[DP complaints form] — Personalised Field
Question: Where can individuals access the firm's online data protection complaints form?
Guidance: Insert the URL or location of the firm's electronic complaints form. Section 103 DUAA requires controllers to facilitate complaints through an electronic form.
Section 3.2 — Step 1: Receipt and logging
[complaints register location] — Personalised Field
Question: Where is the data protection complaints register held?
Guidance: Insert where the firm's data protection complaints register is maintained. Examples: compliance portal, case management system, dedicated spreadsheet on the shared drive.
Section 3.4 — Step 3: Investigation
[investigation target days] — Personalised Field
Question: What is the firm's target timeframe for completing complaint investigations?
Guidance: Insert the number of working days within which the firm aims to complete investigations and provide a final response. There is no statutory maximum, but the ICO expects responses without undue delay.
Section 4.1 — Complaints register
[complaints retention period] — Personalised Field
Question: How long does the firm retain data protection complaint records?
Guidance: Insert the retention period for data protection complaint records. Must align with the firm's data protection and retention policies. Consider regulatory limitation periods.
Section 4.2 — Monitoring and reporting
[complaints reporting frequency] — Personalised Field
Question: How frequently does the DPO report on data protection complaints to senior management?
Guidance: Insert the frequency of DPO reporting to senior management on complaint volumes, trends, outcomes and systemic improvements. Examples: quarterly, bi-annually.