An organisation ignored your data request. Complain to the ICO.
Under the Data Protection Act 2018 you can complain free to the Information Commissioner's Office when an organisation misses the one-month deadline or refuses your request.
You asked an organisation for a copy of your personal data (a subject access request under UK GDPR Article 15) or for it to be erased (Article 17), and it ignored you, refused, withheld data, or demanded a fee. The organisation had one calendar month to respond (Article 12(3)). When it fails, you escalate to the Information Commissioner's Office (ICO).
Section 165 of the Data Protection Act 2018 requires the ICO to consider complaints from data subjects. Complaining is free. The ICO expects you to have raised the matter with the organisation first — which your stage-1 request did — and to complain within three months of your last meaningful contact with them. Send copies (not originals) of your key documents.
The ICO can assess the organisation's compliance, tell it to put things right, and take regulatory action against repeat or serious offenders. Most cases are resolved well before that — a regulator-backed complaint tends to move an organisation that ignored a private request.
Legal mechanisms now in play
- Data Protection Act 2018 s.165 — the ICO must consider data-subject complaints
- UK GDPR Article 15 / Article 17 — the underlying access / erasure right
- UK GDPR Article 12(3) — the one-calendar-month response deadline
- Free to complain; ICO can require compliance and take regulatory action
- Possible court claim for compensation where a breach caused loss or distress
ICO Complaint
Builds a complaint narrative for the ICO: the right you exercised, the organisation and the date of your request, exactly how it failed, your prior contact, and what you ask the ICO to do — assess compliance and require it.
$19.00 ($9.00 if you bought our earlier letter — apply via the receipt URL or QR code in your first letter's PDF)
Start the ICO Complaint →Frequently asked
Do I have to contact the organisation before the ICO?
Generally yes — the ICO expects you to have raised the matter with the organisation first. Your stage-1 subject access or erasure request did exactly that, so you can point to it.
Is there a deadline to complain to the ICO?
The ICO asks you to complain within three months of your last meaningful contact with the organisation. Don't let it drift much past that without a good reason.
Does it cost anything?
No. Complaining to the ICO is free, and the process is designed for individuals. You can also bring a separate court claim for compensation if a breach caused you financial loss or distress.
How long did the organisation have to respond?
One calendar month from your request, under UK GDPR Article 12(3) — extendable by two months for complex requests only if they told you within the first month. Silence past the deadline is a failure you can complain about.
How much does the next-step narrative cost?
$19 standalone, or $9 if you bought our original UK subject access request — your receipt URL or QR code applies the discount automatically.