Data Protection Complaints Procedure

Last updated: 12 October 2026

I am committed to handling your personal information fairly, lawfully and securely. If you are concerned about how I have handled your information, I will take your concern seriously and work to address it.

This procedure explains how to make a data protection complaint and what you can expect from me.

What this procedure covers

You can use this procedure to raise concerns about how I collect, store, use, share, retain or delete your personal information.

Examples include concerns about:

  • Information being shared without an appropriate reason.

  • The security or confidentiality of your records.

  • Inaccurate information.

  • Information being kept longer than necessary.

  • How I have responded to a request to access, correct or delete information.

  • The information I have provided about how your data is handled.

You do not need to use legal language or refer to a particular law. Explaining what you are concerned about is enough.

This procedure applies to clients, former clients, people making enquiries, website visitors and anyone else whose personal information I handle.

If your complaint also concerns your counselling or my professional conduct, I will explain how I will address each part. You do not need to submit the same concern twice.

How to make a complaint

Please contact me, Holly Price, at:

Email: holly@hollyprice.co.uk

You can also raise a concern verbally during a session. If making a complaint in writing is difficult, please let me know so we can agree an accessible way for you to explain your concern.

Where possible, please include:

  • Your name and how you would like me to contact you.

  • What happened and why you are concerned.

  • Any relevant dates.

  • The information involved.

  • Any correspondence or other evidence you would like me to consider.

  • What you would like to happen to resolve the concern.

You do not need to have all this information before contacting me. I will ask for clarification where necessary and explain why any further information is needed.

Please share only information relevant to your complaint.

Complaints made on someone else’s behalf

You can ask someone to help you make a complaint or to act on your behalf.

Before discussing confidential information with them, I will check that they have your authority to do so. This may involve asking you to confirm your permission.

If identity checks are necessary, I will request only proportionate information. I will not ask for more personal information than is needed.

Acknowledging your complaint

I aim to acknowledge your complaint within five working days of receiving it. In all cases, I will acknowledge it within 30 calendar days.

My acknowledgement will confirm that I have received your concern, explain the next steps and identify any clarification needed.

If I am unsure whether you are making a data protection complaint, I will ask you what you would like me to investigate.

Raising a concern will not be used against you or affect your right to fair and respectful treatment.

Investigating your complaint

I will investigate fairly and without undue delay.

Depending on the concern, this may involve:

  • Reviewing relevant records and correspondence.

  • Checking my privacy information, working agreement and procedures.

  • Reviewing how the relevant digital systems have handled information.

  • Seeking clarification from you.

  • Requesting relevant information from a service provider.

  • Obtaining appropriate professional or legal advice.

I will consider your account and the available evidence carefully. Where information needs to be shared to investigate the complaint, I will use an appropriate legal basis and share only what is necessary.

If the complaint identifies an urgent security or safeguarding concern, I will take appropriate protective action promptly. I will not wait for the investigation to finish before addressing an immediate risk.

Keeping you informed

I aim to provide a full response within one calendar month of receiving your complaint, where possible.

Some concerns may require more time. If this happens, I will explain the reason, tell you what remains to be done and give you an updated estimate.

While an investigation remains open, I will provide a progress update at least every ten working days, unless we agree a different arrangement.

These response targets do not replace my responsibility to investigate, keep you informed and communicate the outcome without undue delay.

Requests about your information

A complaint may also include a request to access, correct, delete or otherwise exercise a right over your personal information.

I will recognise and handle that request separately within its applicable legal timeframe. Investigating your complaint does not automatically pause or extend the time allowed for responding to a data protection rights request.

If a right has a legal exception or limitation, I will explain how it applies.

The outcome

I will normally provide the outcome in writing, or in another accessible format agreed with you.

My response will explain:

  • The concern I investigated.

  • The information and evidence considered.

  • My findings and the reasons for them.

  • Any action already taken.

  • Any further action planned and the expected timescale.

  • Your options if you remain dissatisfied.

If I have made a mistake, I will acknowledge it, apologise and explain what I am doing to put matters right or reduce the risk of it happening again.

If I do not agree that a breach occurred, I will explain my reasoning clearly.

If you remain dissatisfied

You can contact me if you believe I have misunderstood your concern, missed relevant information or reached an incorrect conclusion.

I will reconsider the points you raise and explain whether they change the outcome. As a sole practitioner, this is a reconsideration by me rather than an independent internal appeal.

You also have the right to complain to the Information Commissioner’s Office, the UK regulator for data protection and information rights.

The ICO generally encourages people to raise their concern with the organisation first so it has an opportunity to respond. When contacting the ICO, it can help to provide your complaint, my response and any relevant supporting correspondence.

Website: https://ico.org.uk/make-a-complaint/

Telephone: 0303 123 1113

Postal address:
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

The ICO considers data protection matters. Concerns about counselling or professional conduct may fall within BACP’s remit. Information and guidance are available at https://www.bacp.co.uk/gethelp.

Confidentiality and complaint records

I will handle your complaint sensitively and protect the information involved.

I will keep a relevant record of the complaint, investigation, correspondence, findings and actions. Access and disclosure will be limited to what is necessary for handling the matter and meeting applicable legal or professional responsibilities.

Complaint records will be retained for as long as reasonably necessary to resolve the concern, demonstrate how it was handled and address any related regulatory proceedings, legal claim or insurance requirement.

I will review the need for continued retention and securely delete or destroy records when they are no longer required.

Further information about how personal information is handled is available in my privacy policy:

https://www.hollyprice.co.uk/privacy-policy

Learning from complaints

I will use the findings from complaints to review my practice, procedures and digital systems, and make appropriate improvements.

This procedure will be reviewed when relevant legal requirements or practice arrangements change.