Data Protection Complaints Policy

1. Purpose

This policy explains how ETA Green Power Ltd (company number 12359858), receives and manages complaints about its use of personal data. It is designed to meet the UK GDPR, the Data Protection Act 2018 (DPA 2018), including section 164A, and current Information Commissioner’s Office (ICO) guidance. ETA Green Power Ltd is registered with the ICO under registration number ZB395268.

It also supports ETA Green Power Ltd’s accountability duty under Article 5(2) UK GDPR, and the organisational measures required by Article 24. A clear complaint record, reasoned investigation and evidence of corrective action help demonstrate compliance and show that the process is working.

For complaints received, ETA Green Power Ltd must:

• Make it easy for individuals to raise a complaint
• Acknowledge the complaint within 30 days
• Investigate it properly and without undue delay
• Make any enquiries reasonably necessary
• Keep the complainant informed
• Provide the outcome without undue delay.

Section 164A sets these minimum requirements but does not prescribe a particular complaints process or staged procedure.

2. Scope

This policy applies where ETA Green Power Ltd acts as a controller or joint controller. Where ETA Green Power Ltd acts solely as a processor, complaints concerning processing undertaken on behalf of a controller will normally be referred to the relevant controller unless contractual arrangements require ETA Green Power Ltd to assist. It covers complaints from individuals about their own personal data and complaints made by an authorised representative on their behalf. It applies regardless of whether the concern is raised by email, post, telephone, in person, through social media, through another complaints route or with any member of staff.

Where ETA Green Power Ltd is the controller, it remains responsible where a processor helps to manage a complaint. Joint-controller arrangements must identify who coordinates the response. Under current ICO guidance, where joint controllers are involved, the time scale begins as soon as the complaint is received by any of the controllers.

3. What is a data protection complaint?

A data protection complaint is an expression of dissatisfaction or concern from, or on behalf of, a person who considers that ETA Green Power Ltd has infringed data protection law in connection with personal data relating to them. The person does not need to use the word ‘complaint’, cite the law, complete a form or put the matter in writing.

Examples include concerns about:

• How ETA Green Power Ltd collected, used, shared, secured, retained, corrected or deleted personal data
• The accuracy of personal data or a decision affected by inaccurate data
• A lack of transparency or an unexpected use or disclosure
• The way ETA Green Power Ltd managed a subject access request or another data protection rights request
• The effect of a personal data breach, whether the breach is reportable to the ICO.

4. Related matters: identify and route them correctly

A single contact can involve more than one process. Staff must separate the issues, route each to the right owner and coordinate communications so that one process does not hold up another without good reason.

 

If in doubt. Treat the contact as a potential data protection complaint, send it promptly to the Data Protection Lead and ask the person to clarify only what is genuinely unclear. Do not let legal terminology or use of a particular channel be a barrier.

5. How to complain

People may complain through any reasonable channel, including by post, email, telephone, in person, social media, or through another ETA Green Power Ltd communication channel.

For a complaint received through social media, staff should acknowledge it briefly and move the conversation to a secure contact method before discussing personal data.

It helps, but is not compulsory, for a complainant to provide:

• Their name and preferred contact details
• A clear description of what happened and when
• The personal data, service, project or interaction involved
• Copies of relevant correspondence or other supporting information
• What they would like ETA Green Power Ltd to do.

ETA Green Power Ltd will request identity evidence only where there are reasonable doubts and only to the extent necessary. If someone acts for another person, ETA Green Power Ltd will verify their authority before disclosing information or investigating matters that require access to the represented person’s data. These checks must be requested promptly and proportionately.

6. Principles for handling complaints

• Accessible and open. Accept complaints through any reasonable channel and make reasonable adjustments where required.
• Fair and impartial. Consider the complainant’s account and ETA Green Power Ltd’s evidence with an open mind. A person directly involved in the events should not make the final finding where that could undermine impartiality.
• Prompt and proportionate. Start working on receipt, prioritise ongoing harm or serious risk, and make enquiries appropriate to the circumstances.
• Clear and respectful. Use plain English, address the actual points raised and avoid defensive or formulaic responses.
• Confidential and need-to-know. Share complaint information only with people who need it to investigate, decide or implement action.
• No disadvantage. ETA Green Power Ltd will not treat a person unfairly because they complained or contacted the ICO.
• Accountable. Keep a sufficient record of the evidence, reasoning, communications, outcome and follow-up action.

7. Roles and responsibilities

8. Complaint handling procedure

Timing rule. The investigation starts when ETA Green Power Ltd receives the complaint. The 30-day acknowledgement limit is not a waiting period and not a target for starting work.

Stage 1 – Receive, recognise and make safe

• Listen, record the person’s own description of the concern and note the date and channel received. That receipt date remains the start date even if the matter reaches the Data Protection Lead later.
• Send the complaint to the Data Protection Lead without delay, normally by the end of the next working day. Preserve relevant emails, records, system logs and other evidence.
• Identify urgent linked action. If the complaint indicates an ongoing disclosure, security weakness, safeguarding concern, discrimination risk, records-destruction risk or other continuing harm, contain and escalate it immediately. Start any separate breach, rights, grievance or whistleblowing process in parallel.
• Log the complaint and allocate a handler with suitable knowledge and sufficient independence. If the complaint concerns the Data Protection Lead or another conflicted person, appoint an uninvolved senior manager or suitably independent adviser.

Stage 2 – Acknowledge and define the issues

ETA Green Power Ltd will acknowledge receipt within the statutory period. ETA Green Power Ltd’s service aim is to acknowledge within five working days wherever practicable.

The acknowledgement should:

• Confirm the date received and that ETA Green Power Ltd will investigate the matter
• Summarise the issues as understood, or ask a focused clarification question
• Give the handler’s contact details or a reliable point of contact
• Explain any identity or authority evidence genuinely needed
• State the next step and, where possible, an expected response date
• Confirm any linked process being managed separately.

An acknowledgement may be verbal, but ETA Green Power Ltd should normally confirm it in writing and retain evidence that it was given. If ETA Green Power Ltd provides a full outcome within 30 days, a separate acknowledgement is not required.

Stage 3 – Investigate promptly

The handler must make enquiries that are fair, accurate and proportionate to the complaint. This will usually involve:

• Turning the complaint into clear issues or questions to be decided
• Reviewing relevant personal data, correspondence, policies, notices, contracts, audit trails, logs and decisions
• Speaking to relevant staff and, where needed, obtaining information from processors or joint controllers
• Checking the applicable legal requirements and ETA Green Power Ltd’s own stated standards
• Considering the complainant’s desired outcome without treating it as determinative
• Identifying whether any infringement, control weakness or unfair impact is continuing
• Recording the evidence considered, key facts, analysis and reasons.

The extent and speed of the investigation must reflect complexity, scale, the availability of evidence, the seriousness and duration of any harm, and whether urgent corrective action is possible. ETA Green Power Ltd is not required to take unreasonable or disproportionate steps, but the record must explain why the enquiries were sufficient.

ETA Green Power Ltd aims to provide an outcome within 30 calendar days where reasonably practicable. This is an internal service aim, not a statutory long stop. Straightforward cases should be completed sooner. A complex case may take longer only where justified; the handler must continue active work and avoid waiting for unrelated parts of a wider complaint. Any delay must be justified and recorded by reference to the complexity, risk and relevant dependencies.

Stage 4 – Keep the complainant informed

ETA Green Power Ltd must keep the complainant informed promptly. If the outcome cannot be provided by the date previously indicated, the handler must update the complainant before that date. For a continuing investigation, updates should normally be provided at least every 20 working days, and sooner where risk, harm or a significant change makes this appropriate.

A progress update should briefly explain the current position, any justified reason for delay, the next step and a realistic, revised date. It need not disclose confidential staff information, legal advice, or another person’s data or investigative detail that cannot properly be shared.

Stage 5 – Decide and communicate the outcome

When enquiries are complete, ETA Green Power Ltd must inform the complainant of the outcome as soon as reasonably practicable. The response should be appropriate to the case and should:

• List or clearly summarise each complaint point
• State whether each point is upheld, partly upheld, not upheld, withdrawn or cannot be determined on the available evidence
• Explain the relevant facts, evidence and reasoning in enough detail to make the conclusion understandable
• Acknowledge and apologise for failings where appropriate, without evasive language
• State any remedy or corrective action, who owns it and an appropriate completion date
• Explain the optional internal review route
• Explain that the complainant may complain to the ICO at any time and does not have to complete ETA Green Power Ltd’s review first.

Action includes correcting or deleting data, restricting or stopping processing, providing information, revisiting a decision, improving security, changing a notice or process, retraining staff, addressing a processor issue, or offering another proportionate remedy. The response must not disclose another person’s personal data or confidential information without a lawful basis.

Stage 6 – Optional internal review

A complainant who remains dissatisfied may ask for one internal review, preferably within 20 working days of the outcome. ETA Green Power Ltd may accept a later request where fair and reasonable. The request should identify what the complainant believes was missed, misunderstood or decided incorrectly. ETA Green Power Ltd must assist if the person cannot put this in formal terms.

The reviewing manager will be sufficiently independent of the original decision and will focus on whether the complaint was managed fairly, the enquiries were sufficient, the evidence supports the conclusions and the remedy is appropriate. Further enquiries should be made only where needed. ETA Green Power Ltd aims to issue the review outcome within 20 working days and will explain any justified delay.

The internal review process is a voluntary service-quality mechanism offered by ETA Green Power Ltd. It is not a reconsideration or suspension of the complainant’s legal rights and does not affect their right to complain directly to the Information Commissioner’s Office. It is not a legal precondition to contacting the ICO and must not be presented as one.

Vexatious, excessive and repetitive complaints

ETA Green Power Ltd will deal fairly with all complaints while using resources proportionately. Where a complainant repeatedly raises identical issues that have already been fully considered and answered, ETA Green Power Ltd may limit further correspondence, use a single point of contact or decline to repeat the same investigation. It will continue to consider new evidence, new issues, continuing data protection risks and reasonable adjustment needs. The reason for limiting correspondence must be recorded and explained to the complainant. It does not restrict the person’s right to complain to the ICO.

9. Escalation during handling

The complaint handler or Data Protection Lead must promptly escalate a matter to the Managing Director and relevant operational owner where it indicates:

• A likely serious or systemic infringement, significant harm or continuing high risk
• A personal data breach that may require ICO notification or communication to affected people
• Possible deliberate misuse, concealment, retaliation, fraud or other misconduct
• Significant litigation, regulatory, contractual, financial or reputational exposure
• A need to stop processing or make an urgent organisation-wide change
• A conflict of interest that cannot be managed internally.

Escalation is for risk management and authority, not an extra approval layer for routine complaint outcomes. It must not cause unnecessary delay.

10. Complaints involving children, representatives or accessibility needs

Children have data protection rights. Communications must be clear and age appropriate, and ETA Green Power Ltd will assess the child’s capacity to understand and exercise their rights where this is relevant. Any safeguarding concerns must be addressed immediately under ETA Green Power Ltd’s safeguarding procedures.

ETA Green Power Ltd will accept authorised representatives and verify authority proportionately. Where a complaint is anonymous or authority cannot be established, ETA Green Power Ltd will still assess any credible compliance or security risk it can investigate without disclosing protected information but may be unable to provide a personal outcome.

ETA Green Power Ltd will make reasonable adjustments and provide an alternative format or communication method where needed. Equality and accessibility obligations apply throughout the process.

11. Records, retention and confidentiality

The Data Protection Lead must maintain a complaint register and a proportionate case file. The file should contain enough information to show what ETA Green Power Ltd received, what it did, why it reached its conclusion and whether promised action was completed. It should not become a duplicate store of every underlying record.

 

Complaint records are personal data. Access must be limited to people who need it, and records must be protected against unauthorised access, alteration, loss or premature destruction. ETA Green Power Ltd will retain closed complaint files in line with its retention schedule, normally for six years after closure, unless a longer or shorter period is justified by legal claims, regulatory action, safeguarding, an audit need or the nature of the case. At the end of the period, records must be securely deleted or anonymised.

Section 164B DPA 2018 allows the Secretary of State to make regulations requiring controllers to notify the ICO of complaint numbers. Section 164B does not, by itself, create a current routine reporting duty. The Data Protection Lead will monitor any regulations made under that power and update ETA Green Power Ltd’s arrangements if required.

12. Learning, trends and assurance

After closure, the handler should identify any immediate lessons and confirm that corrective action has an owner and due date. The Data Protection Lead will periodically review complaint information for recurring causes, affected systems or activities, response delays, missed commitments, repeat breaches and incomplete actions.

Significant themes and overdue high-risk actions will be reported to senior management promptly. A concise summary will be provided at least annually, covering volumes, themes, timeliness, outcomes, serious cases and improvement progress. This does not require a separate committee. Reporting should use aggregated or anonymised information unless case-level detail is necessary.

Complaint records help ETA Green Power Ltd demonstrate compliance and identify opportunities for improvement.

13. Complaining to the Information Commissioner’s Office

A person may complain to the ICO at any time. They do not have to wait for ETA Green Power Ltd to complete an internal review. The ICO will often ask whether the person has first raised the matter with ETA Green Power Ltd, but this does not remove or postpone their right to approach the ICO.

ICO contact information and the online complaint route are available at ico.org.uk/make-a-complaint. Current ICO contact details are available on that website.

ETA Green Power Ltd will cooperate with the ICO and preserve relevant records. Staff must not contact the ICO merely because a complainant says they intend to do so. The ICO will contact ETA Green Power Ltd if it needs information.

14. Compliance, monitoring and non-compliance

Failure to follow this policy can expose individuals and ETA Green Power Ltd to avoidable harm, regulatory scrutiny and loss of trust. Staff must raise actual or suspected non-compliance promptly with their manager or the Data Protection Lead. Deliberate obstruction, concealment, retaliation or unauthorised disclosure may be addressed under the relevant disciplinary or contractual arrangements.

15. Ownership and review

The CEO adopts this policy and is responsible for ensuring that adequate resources, processes and controls are in place for its effective operation.

The CFO is the Person Responsible for Data Protection and oversees the complaints process, monitors compliance and ensures significant risks are escalated. Keith Hebborn of Hebborn Consultancy Ltd is ETA Green Power Ltd’s appointed external Data Protection Officer and joint complaint contact. Either may coordinate a complaint where one is unavailable or conflicted; the other will ensure that an appropriate and sufficiently independent handler is appointed.

This policy will be reviewed in the IMS audit schedule and sooner following a significant complaint, audit finding, change in law or ICO guidance, or a substantial change to ETA Green Power Ltd’s processing or complaints arrangements. Material amendments require approval by the Board of Directors. The CFO may approve minor, non-material amendments, which must be version controlled.

 

Appendix A – Staff quick guide

Remember: Recognise it, record it, route it, preserve evidence and escalate urgent risk. Do not wait for the person to use legal language or a special form.

 

Appendix B – Outcome response checklist

• Answer each complaint point.
• Base the findings on evidence and explain them plainly.
• State any action, its owner and the expected completion date.
• Do not disclose third-party personal data or confidential information without a proper basis.
• Update the register, record any lesson and signpost the ICO.

 

Appendix C – Legal and regulatory references