Data Protection Complaints 

If you are unhappy with how the University has handled your personal data, or you are dissatisfied with the handling of an information rights request, you have the right to make a complaint.  

Anonymous complaints will not be accepted.  If the University has reason to question the identity of a complainant, we will ask for identification.  This will be in the form of a copy of your passport, photo driving licence or similar. 

How to make a complaint 

You should submit your complaint in writing by contacting the Information Governance Unit at info.access@durham.ac.uk

To help us investigate your concern, please provide: 

• Your name and contact details
• Student or staff number if applicable
• Your relationship with the University
• A clear description of the issue.  Include relevant details including what happened and what personal data was involved
• Relevant dates and any supporting evidence
• Details of the resolution you are seeking

Providing full information will help us deal with your complaint more quickly.  

Who can complain? 

You should normally be the person whose data is involved. If someone is acting on your behalf, we will need your written consent. We may also ask for proof of identity before progressing the complaint. 

What happens next? 

• We will acknowledge your complaint within 30 calendar days.  
• We will assess whether your complaint falls within this process.  Complaints that fall outside the scope of data protection will be redirected to the correct procedure. 
• We may contact you if we need further information 
• We will investigate the issues and review relevant information
• You will receive a full response without undue delay. 

How we handle complaints

Your complaint will be handled confidentially and only shared with staff who need to be involved in the investigation.  In some cases, this may include staff named in your complaint so they can respond. 

When we may not investigate 

We may decide not to investigate a complaint if it is: 

• Outside the scope of data protection 
• Repetitive or already considered 
• Clearly unfounded or excessive 

If this happens, we will explain our reasons.  

What if you are still not satisfied with our response?

If you remain unhappy after receiving our response, you have the right to complain to the Information Commissioner’s Office (ICO), the UK regulator for data protection.

An online form is available here: Make a complaint about data protection and personal information | ICO