Data Protection Complaints Procedure
Last reviewed: July 2026
This procedure sets out how PWM Communications Ltd (“PMW”) receives, acknowledges, investigates and responds to complaints from individuals about how we process personal data.
It is designed to ensure that complaints are handled fairly, promptly and consistently, and that individuals can exercise their rights under applicable UK data protection law.
This procedure supports PMW’s obligations under the Data (Use and Access) Act 2025, the Data Protection Act 2018, and the UK General Data Protection Regulations (UK GDPR), as well as other relevant data protection legislation.
Who can complain and what about?
Any individual whose personal data we process may make a data protection complaint.
This includes, but is not limited to:
- Clients and prospective clients
- Employees, workers and job applicants
- Suppliers, contractors and consultants
- Business contacts
- Competition entrants
- Website users
- Any other individual whose personal data we process
A data protection complaint includes concerns relating to any of the below:
- The way we collect, use, share, store or delete personal data
- The accuracy or completeness of personal data
- Subject access requests or other individual rights requests
- Data breaches or information security concerns
- Direct marketing communications
- Automated decision-making or profiling
- International transfers of personal data
- Any other breach of UK data protection legislation
How to complain
We accept data protection complaints regardless of how they are made. Complaints may be submitted in writing, by email, by telephone or in person.
To help us to fully investigate and resolve your complaint, please provide as much information as possible, including:
- Your name and contact details
- A detailed description of your complaint
- Any relevant dates, events or correspondence
- Copies of any supporting documentation or evidence
We also accept complaints from authorised representatives on behalf of another individual. However, before discussing or disclosing personal data, we may ask for evidence that they have the appropriate authority to act on that person’s behalf.
Contact details
Please direct data protection complaints to our Data Protection Lead. Complaints may be made using any of the following methods:
- Post
PMW Communications Ltd, Stane Court, Stane Street, Billingshurst,
West Sussex, RH14 9HP
- Telephone
- In person or verbally
To any member of staff
Complaints handling process
1.
Acknowledgement
We’ll log and acknowledge receipt of a complaint promptly, without undue delay and within 30 days. We’ll provide confirmation of our understanding of the issue raised, explain next steps, and, where necessary, we may request additional information we need to investigate your complaint.
2.
Investigation
We will review and investigate your complaint fairly, impartially and proportionately, as soon as possible. This will include reviewing relevant records, processing activities, systems and any relevant policies and procedures. We may speak to members of staff, and/or contact you for further information, where appropriate.
3.
Outcome
Once our investigation is complete we’ll let you know whether your complaint is:
- Upheld
- Partially upheld
- Not upheld
We will communicate this to you in writing, explaining the reasoning for our decision, and if appropriate, what actions we are taking or are proposed, to rectify the situation, which could include things such as:
- Correcting inaccurate data records
- Restricting, changing or stopping certain processing activities
- Making improvements to policies, procedures or staff training
- Implementing additional technical or organisational security measures
4.
Escalation
We’ll also let you know what your rights are if you are dissatisfied with our response, including your right to raise the matter with the Information Commissioner’s Office (ICO).
Complaints about work we do for clients
When we run a campaign using a client’s data, such as their mailing list, their customer records or their competition entries, the client is the Data Controller and PMW acts as the Data Processor.
In this situation, the client is legally responsible for answering complaints and requests relating to that data. If we receive such a complaint directly, we will notify the client as soon as is reasonably possible, provide any reasonable assistance required under our contractual obligations and support them with investigating and responding to the complaint where appropriate.
If you complain to us on behalf of our client as the Data controller, we will:
1.
Log and acknowledge the complaint
We will confirm we have received your complaint and let you know which organisation is responsible as the Data Controller.
2.
Notify the client promptly
We will send the full complaint in writing to the client’s nominated data protection contact (or other appropriate contact) within two working days.
3.
Provide assistance where we can
In line with our Data Processing Agreement obligations, we’ll assist the client in meeting their responsibilities with investigating and responding to the complaint. That usually means telling them what we sent, to whom, when and on what basis.
4.
We’ll keep you informed
We will let you know who has your complaint and confirm when we passed it to them. Where possible, we will provide you with their contact details if you need to communicate with them directly.
5.
We’ll keep a record
We will record your complaint in our internal log, noting that it relates to our role as a data processor, and record the date it was passed to the client.
Where the complaint relates to our own data – such as our own marketing lists, our employees, our suppliers, our website and cookies – we are the data controller, and this procedure applies in full.
Where it’s genuinely unclear, we’ll treat it as our responsibility until the Data Protection Lead decides otherwise.
Your right to escalate your complaint
If you’re unhappy with our response, or you believe we have not handled your personal data in accordance with UK data protection law, you have the right to complain to the UK’s data protection regulator, the Information Commissioner’s Office (ICO).
You can use the following methods to contact the ICO:
The ICO generally expects individuals to raise their concerns with the organisation involved before asking it to investigate. We encourage you to contact us first, so that we have the opportunity to resolve your concerns.