Data protection and privacy

Data protection complaints procedure

This procedure sets out how Liverpool City Council will handle complaints relating to our processing of personal data, in line with our obligations under the Data (Use and Access) Act (DUAA) 2025.

If you are unhappy with how we have handled your personal information, you can make a data protection complaint.

This includes concerns about how we collect, use, store or share your personal data, or if you are unhappy with how we have responded to a request relating to your information.

What you can complain about

You can make a complaint if you think we have:

  • used your personal information incorrectly
  • shared your information when we should not have
  • failed to protect your information properly
  • not responded appropriately to a Subject Access Request (SAR)
  • not handled another data rights request correctly
  • made a decision about you using an automated process and you would like it reviewed by a person
  • used cookies or tracking technologies in a way you believe is inappropriate

How to make a complaint

You do not need to use legal terms such as "data protection", "GDPR" or "DUAA" when making your complaint. If you are unhappy with how your information has been handled, we will make sure it is considered under this process.

Contact us and explain your concerns. To help us investigate, please provide:

  • your name and contact details
  • details of what happened
  • when the issue occurred
  • any supporting information or correspondence

Email: dpo@liverpool.gov.uk (please include 'Data protection complaint' in the subject field)

If we need to confirm your identity or need more information, we will contact you.

What happens after you complain

We will acknowledge your complaint within 30 days of receiving it. 

We will confirm that we have received your complaint, what we will investigate and whether we need any further information from you.

If the 30-day statutory deadline falls on a weekend or bank holiday, we'll respond on the next working day.

Our Information Governance team will begin investigating your complaint as soon as possible. This may include:

  • reviewing relevant records and systems
  • checking audit logs and information held by the council
  • speaking to the service involved

We will keep you updated

If your complaint is complex or involves several council services, we will keep you informed of our progress.

Most complaints should be resolved within three months. If we need longer, we will explain why and tell you when you can expect a final response.

We will send you our decision

Once our investigation is complete, we will write to you with:

  • what we investigated
  • the evidence we considered
  • our findings
  • any action we have taken to address the issue

If you are not satisfied with our response

If you remain unhappy after we have completed our investigation, you can complain to the Information Commissioner's Office (ICO).

The ICO is the UK's independent authority responsible for upholding information rights.

Visit: www.ico.org.uk 

Repeated or unreasonable complaints

We will consider every complaint fairly and on its own merits.

In some circumstances, we may refuse to investigate a complaint if it is:

  • a repeat of a complaint that has already been fully investigated
  • clearly unreasonable or excessive
  • intended to disrupt council services rather than resolve a genuine concern
  • malicious or abusive

If we decide not to investigate a complaint, we will explain our reasons in writing and tell you how to escalate your concerns.

Reviewing this procedure

We review this procedure every year and update it when required to reflect changes in legislation, guidance or council policy. 

This policy was last reviewed and updated in September 2026. Read the policy in full:

  • Data protection complaints procedure

    Download this document: Data protection complaints procedure (PDF: 357 KB)

    This procedure outlines how the council receives, acknowledges, investigates, and resolves complaints from individuals regarding the handling of their personal data. This procedure has been developed to align with the Data (Use and Access) Act 2025 (DUAA).

    First published: 29/09/2026

If you have any questions about this procedure, please contact:

Paul Mountford - Principal Information Governance Manager and Data Protection Officer

Email: paul.mountford@liverpool.gov.uk