Data Protection Complaints Handling Proceedure
This Data Protection Complaints Handling Procedure (‘this Procedure’) is effective from 19 June 2026.
Any questions about this Procedure should be directed to the firm’s Data Protection Officer (‘the DPO’), who is currently Craig O’Hara (email: craig.ohara@chlsolicitors.co.uk, telephone: 01625 531 676).
Chafes Hague Lambert LLP (‘the Firm’, ‘we’ or ‘us’) has legal obligations under the UK General Data Protection Regulation and the Data Protection Act 2018. If an individual considers that we have breached data protection laws, they have the right to make a complaint directly to us, to the Information Commissioner’s Office (‘the ICO’) or to pursue legal action.
This Procedure sets out how individuals may raise a data protection complaint with us and how we will deal with such complaints. It should be read together with our Privacy Policy. It covers complaints from any data subject or their authorised representatives.
Complaints under this Procedure must relate directly to data protection issues but the legislation does not specifically define a data protection complaint. The scope of data protection complaints is therefore wide and could relate to the way we collect or use someone’s personal information, their data protection rights (such as the right of access, correction or erasure), our Privacy Policy, how long we keep their information or security.
This Procedure does not cover general service complaints, which are dealt with under our Client Complaints Handling Procedure.
We are committed to handling data protection complaints in line with our legal obligations and in an accessible, fair, transparent and timely manner. We will handle complaints confidentially and only share information where appropriate to investigate and resolve the complaint, as required or authorised by law or otherwise in accordance with our Privacy Policy and our Terms of Business. We will aim to avoid conflicts of interest.
The DPO is responsible for co-ordinating how we handle data protection complaints. The DPO will involve relevant management, business, HR, IT, security, risk or compliance partners or staff as needed.
-
Raising a data protection concern informally.
In the first instance, we encourage seeking an informal resolution before a formal complaint is made. This may be done by contacting the DPO to express your concerns. It may be that informal discussions can resolve the matter without the need for further action.
If we are unable to resolve your concerns informally or you feel that the matter is more serious, you can make a formal complaint using this Procedure.
-
How to make a formal complaint under this Procedure.
An individual may submit a data protection complaint to us by contacting the DPO using any of the following options:
- By email to craig.ohara@chlsolicitors.co.uk.
- By post to 22 Church Street, Wilmslow, Cheshire, SK9 1AU.
- By telephone on 10625 531 676.
Where your complaint is made through social media or another insecure public channel, and we are made aware of it, we will ask you to continue the complaint through a more secure method to protect your data.
You may instruct a third party to make a complaint under this Procedure on your behalf but for this to happen they will have to have your clear consent to do so and to provide evidence of your consent, such as a signed letter of authority, to us when raising your complaint. We cannot progress such complaints unless adequate proof of authority is provided to us.
-
Required information and documents.
You should provide as much information as you can about your complaint, including:
- The nature of your concern or of the issue to be reported.
- Your reason(s) for believing that what you are reporting is an issue.
- The impact on you.
- Whether any action has already been taken by anyone.
- Any steps that you have taken to resolve the matter.
We may ask you for information or documents to confirm your identity before we proceed to deal with your complaint.
Where reasonably necessary to investigate your complaint, we may ask you for additional information, including information to clarify the scope of the complaint. We will only request information that is reasonable and proportionate in the circumstances and will not request more information than we require to identify and deal with the complaint.
7.Complaints involving children or vulnerable individuals.
Where we receive a complaint from, or on behalf of, a child or other vulnerable individual, we will consider, on a case by case basis, whether any additional safeguards are required to ensure our process is fair, transparent and accessible to the individuals concerned, having regard to age, understanding and any other relevant circumstances.
We must acknowledge receipt of a data protection complaint within 30 days of receipt but will aim to acknowledge receipt within 10 working days of receipt.
We will aim to:
- Request any further information, including for clarification or identification purposes, within 20 working days.
- Provide updates at least every 20 working days.
- Reach an outcome within 60 working days.
There may be some occasions where we need additional time to respond, for example where it is a complex matter and additional time is needed to fully investigate your concerns. Where it is a complex matter and additional time is needed, we will keep you informed of our progress, including, where appropriate, the next steps, any further information required, and any expected timeframe for the next update, or outcome.
9.Outcomes.
We will communicate to you, in writing, the outcome of our investigation into your complaint without undue delay, explaining our findings, whether the complaint is upheld (in whole or in part), any action taken or proposed, and, where no action is taken, the reasons for that decision.
-
If you are not satisfied with the outcome.
We will try to deal with your complaint fairly and in an appropriate way, but we understand that there may be occasions where individuals are unhappy with the outcome. If you are unhappy with the outcome of our investigation or with the way in which your complaint was handled then you have the right to complain to, or seek guidance from, the ICO. Further details are available at www.ico.org.uk.