The ICO regulates data protection and information rights; it can assess complaints about personal-data handling, FOI and EIR, but it is not a general consumer-compensation scheme.
For data protection, the ICO can consider concerns such as SAR handling, accuracy, rectification, erasure, security, lawful processing and organisational complaint handling. For public information, it can decide complaints under FOIA and EIR.
The ICO’s role is regulatory and supervisory. A finding or regulatory intervention can be very important, but the ICO does not normally award you compensation for distress or financial loss.
Key points
- Complain to the organisation first and keep its response.
- For FOI/EIR, follow the authority’s review/complaint route where required before going to the ICO.
- Frame the complaint around specific data-protection or information-rights obligations.
- If compensation is your objective, the ICO is not a substitute for a court or another redress route.
Data-protection complaints
Explain what personal data or processing is in issue, what right/principle you rely on, what you asked the organisation to do, what it did, and why the response remains inadequate. Include the request, complaint, response and decisive evidence.
FOI and EIR complaints
The ICO can consider refusal, delay, exemptions/exceptions, adequacy of searches and procedural handling. Its current public guidance asks requesters to follow up overdue requests and normally seek an internal review/complain to the authority before escalating.
What an ICO outcome means
The ICO may provide an assessment, require or recommend action, issue decision notices in information-access cases or take regulatory action where appropriate. The practical effect depends on the type of case.
In practice
- Do not send the ICO only a narrative; identify the exact right or principle in dispute.
- Use a chronology showing request date, ID/clarification exchanges, deadline, response and complaint.
- If inaccurate data is being shared with third parties, identify the data, recipients and correction requested.
What to do
A practical next-step plan
- Complain to the controller/public authority.
- Gather the request, response and challenge correspondence.
- Identify each unresolved issue.
- Submit the complaint through the correct ICO route.
- Continue preserving evidence because an ICO complaint does not pause every other legal or ombudsman deadline.
Common traps
Things that often confuse the issue
- Using the ICO for a general service complaint with no information-rights issue.
- Assuming the ICO will calculate or award damages.
- Failing to distinguish FOI from SAR when asking for your own personal data.
Evidence worth keeping
Where to go next
If you need personal compensation or another remedy beyond the ICO’s role, consider the relevant ombudsman/ADR or legal route separately.
Understand what the outcome can and cannot do
An ICO outcome can be important evidence and can require or encourage corrective action within the regulator’s powers, but match the requested remedy to the route. A regulatory finding, a FOI decision notice and a civil compensation claim are different legal outcomes.
Keep the routes separate.
Regulator, ombudsman/ADR, statutory appeal and court proceedings can have different purposes, powers and deadlines. Using one route does not automatically preserve another.
Build the complaint for an independent reader
Give the ICO an issue map: legal right/request, organisation response, disputed exemption or factual proposition, documents, and the outcome you want. Where data accuracy is disputed, show why the source evidence is more reliable than the organisation’s entry. Where information is missing from a SAR, identify categories or systems rather than simply alleging that “there must be more”.
| If they say… | What to check or say back |
|---|---|
| “The ICO will make the company pay me compensation.” | The ICO can regulate and reach findings, but compensation is normally a separate settlement/court question. |
| “We acknowledged your privacy complaint, so the SAR deadline restarts.” | Complaint handling and the underlying statutory right have distinct timing rules. |
| “We checked our system and the data is accurate.” | Ask what reasonable steps were taken and provide the evidence said to contradict the record. |
| “The ICO is dealing with it, so no further action is needed.” | Preserve any separate court, ombudsman or sector deadline. |
Check jurisdiction and timing before writing the full case
Do the gateway checks first. A perfectly argued complaint can still fail if it is sent to the wrong body, too early, too late or against a respondent outside the scheme.
- For a data-protection complaint, raise the issue with the organisation first and preserve the complaint and response. Since June 2026 organisations have statutory duties for handling data-protection complaints, including a route for complaints and acknowledgement within 30 days.
- For SAR/rectification/erasure disputes, identify the exact request, date, scope and response rather than submitting only a general privacy complaint.
- For FOI/EIR, retain the original request, refusal notice and internal-review correspondence.
- Keep any court limitation issue separate; an ICO complaint is not automatically a limitation standstill.
Is Information Commissioner’s Office (ICO) actually the right body?
The ICO regulates data protection and freedom-of-information law. It can consider complaints about organisations’ handling of personal-data rights and complaints about public authorities under FOI/EIR, but the route and powers differ. It is not a court awarding ordinary damages for distress or financial loss.
For data-protection compensation, a negotiated settlement or court claim may be required. For FOI/EIR, follow the authority’s review route where applicable before asking the ICO to decide the information-rights complaint.
Official sources
Check the rules behind this guide
- ICO - Make a complaint
- ICO - UK GDPR guidance and resources
- ICO - FOI and EIR complaints
- ICO: Complain about an organisation ↗
These are official or primary sources for this topic. Rules, scheme terms and deadlines can change, so check the live source before relying on a formal time limit or procedure.