Data Protection Complaint Handling Policy
Policies
Privacy
1.1 Purpose and Objective:
Policy statement
Logical Holdings Limited (and its subsidiaries, being Scott Logic Limited and Marra Limited as at the date of this policy) (Group) has legal complaint handling obligations under the UK GDPR, Part 3 of the Data Protection Act 2018 and under the Data (Use and Access) Act 2025. If an individual considers that we have breached data protection laws, they have the right to make a complaint directly to us, to the Information Commissioner’s Office (ICO) or to pursue legal action.
These complaints must relate to data protection but the legislation does not specifically define a data protection complaint. The scope of complaints is therefore wide and could relate to the way we collect or use someone’s personal information, their data protection rights (such as the right of access, correction or erasure), our privacy notices and policies, how long we keep their information, security, or other matters relating to data privacy and
security.
Applicability
This Policy outlines our approach to handling data protection complaints. It should be read together with our Data Protection Policy. It applies to all employees, workers, contractors and third parties acting on our behalf.
Objectives
We are committed to handling data protection complaints in line with our legal obligations and in an accessible, fair, transparent and timely manner. We will handle complaints confidentially and only share information where appropriate to investigate and resolve the complaint, as required or authorised by law or otherwise in accordance with our privacy policies. We will aim to avoid conflicts of interest. All line managers are responsible for ensuring all Company Personnel comply with this Data Protection Policy and need to implement appropriate practices, processes, controls and training to ensure that compliance.
Our Data Protection Officer is responsible for co-ordinating how we handle data protection complaints. They will involve relevant business, HR, IT, security, risk or compliance and legal teams as needed.
All staff are responsible for recognising complaints and referring them to Data Protection Officer promptly as well as for providing supporting information and responding to requests from Data Protection Officer when asked.
Our Data Protection Officer is responsible for ensuring staff are aware of and trained sufficiently to deal with data protection complaints.
The Group General Counsel is responsible for overseeing this Data Protection Complaints Handling Policy.
Legislative Framework
Data Protection matters are governed by a selection of legislation and guidance issued by the Information Commissioner’s Office (the ICO). This includes (without limitation), the UK GDPR, the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003, the Data (Use and Access Act) 2025 and any related guidance.
1.2 Policy Requirements:
We all have a responsibility to comply with the legislation listed above and each of us will do so by complying with the requirements set out in this policy.
Transparency
We will provide information about how to submit a data protection complaint. We will make this obvious and easily accessible to individuals, including in our privacy notices, via our website, on social media, in person and, where relevant, through internal channels or customer-facing portals. Using plain and clear language, we
will explain:
- Our data protection complaints process.
- How individuals can make a data protection complaint.
- How we will respond if we consider the complaint is not a data protection matter.
- The available complaint channels.
- The information we require to investigate a complaint.
- What we do with that information and why (for example, investigations, establishing the facts, complaint resolution).
- How we handle complaints which might be sensitive in nature.
- What individuals can expect from the process.
- When individuals can expect to hear from us, including status update communications such as acknowledgements, progress updates and outcomes.
- Any reasonable support we provide to help individuals make complaints such as alternative formats or language options.
Non-data protection complaints
Some complaints will include both data protection and non-data protection issues; we will handle the data protection aspects under this Policy. Non-data protection issues will be addressed under the relevant HR, grievance, or other applicable procedure.
Complaint channels
People may submit a data protection complaint using our Complaints Form (set out in the Annex to this policy) to us using any of the following options:
- By email to privacy@scottlogic.com
- By post to FAO: DPO, Scott Logic Limited, 6th Floor, The Lumen, St James Boulevard, Newcastle Helix, Newcastle Upon Tyne, England, NE4 5BZ
To expedite the complaint, we will encourage people to use our established complaint channels. They may still choose to submit a complaint through any of our “contact us” channels. We will accept and route these complaints appropriately.
Where a complaint is made through social media or another insecure public channel, we will ask the complainant to continue the complaint through a more secure method to protect their data.
Requesting additional information
Some complaints may be easy to resolve; others may require further investigation. Where reasonably necessary to investigate a complaint, we may ask the complainant for additional information, including information to verify their identity or to clarify the scope of the complaint. We will only request information that is reasonable and proportionate in the circumstances and will not request more information than we require to identify the complainant or their representative.
Where a complaint is made on behalf of another individual, we may require evidence such as a power of attorney or signed letter of authority indicating that their representative is authorised to act on their behalf. We cannot progress complaints unless adequate proof of authority is provided. Where this is the case, we will explain it to the person who submitted the complaint.
Complaints to or about processors or partners
Where a complaint received by us relates to the processing of personal information by our service providers, we will ask these providers to provide us with details and information relevant to the complaint without undue delay and in accordance with any agreed and specified terms within our contract with the service provider. Where a service provider receives a complaint about the processing of our personal data whether by them or us, they should forward this to us without undue delay. Service providers are under no obligation to handle complaints on our behalf unless this has been agreed between us and the relevant service provider(s) under a binding contract. Where applicable, we will ask service providers to handle such complaints in line with our policies and procedures.
Where we process personal information acting as a service provider on behalf of a controller, we will only handle complaints under arrangements agreed and specified within a binding contract between us and the controller(s). If the controller disappears, no longer exists or has become insolvent, we will handle complaints in line with this Policy and its associated procedures. Any such complaint should be sent to the Data Protection Officer.
Record keeping
We will keep appropriate records about each data protection complaint. Records include:
- The date of receipt.
- The acknowledgement.
- Any relevant correspondence, conversations and documents.
- The outcome of the complaint, including escalation, and any actions taken in response.
- Any other relevant information with respect to the complaint.
These records will be used to demonstrate compliance, for audit and monitoring purposes, training, to support consistent handling and to identify recurring issues, trends or areas for organisational improvements or remediation.
We will not retain personal data relating to complaints for longer than is necessary and will handle such records in accordance with our retention and data protection policies.
Acknowledgement and timeframes
We must acknowledge receipt of a complaint within 30 days of receipt.
For ongoing investigations, we will communicate this to individuals with an indication of our initial, anticipated timescales for resolving the complaint. We will continue to keep the complainant informed of our progress, including, where appropriate, the next steps, any further information required, and any expected timeframe for the next update, or outcome.
Investigations
We will take reasonable and proportionate steps necessary to investigate complaints fairly and in a timely manner.
We have processes in place to classify and escalate complaints that are time-sensitive, more serious or sensitive in nature. It may take us longer to investigate and resolve complaints which are complex, serious or which relate to multiple data protection issues.
Outcomes and escalation
We will communicate the outcome of the complaint to the complainant without undue delay, explaining our findings, whether the complaint is upheld (in whole or in part), any action taken or proposed, and, where no action is taken, the reasons for that decision.
We have processes in place for reviewing and escalating complaints where the complainant is unsatisfied with our complaint handling as we progress the complaint or the outcome.
If the complainant objects to our handling of their complaint or disputes the outcome or any aspect of our response and notifies us, we will escalate the matter to the Data Protection Officer. They will review the matter and respond to the individual with their decision on our complaint handling, whether to accept the original finding or to substitute a new finding or alternatively escalate the complaint to an appropriate reviewer.
Where reasonably practicable, any internal review will be carried out by a person who was not primarily responsible for the original response.
The Data Protection Officer will respond to the individual within seven working days of the referral to the Data Protection Officer. If the complaint is upheld, the Data Protection Officer will ensure that necessary steps are taken as a result, such as correction, deletion, apology, security remediation, or process changes.
Once the matter has been escalated to the Data Protection Officer and a decision issued, this decision is final. No further action will be taken and the complainant will be informed of this.
If the complainant is dissatisfied with the outcome of the complaint, we will inform them that they have the right to lodge a complaint with the ICO and, where appropriate, provide them with details of how to do this. They also have the right to complain to the ICO at any time and to lodge a claim before a competent court, irrespective of whether they have lodged a complaint with us using our complaints process.
Monitoring and audits
We will routinely monitor and audit our data protection complaint handling to ensure we can maintain performance levels in line with our legal obligations, our own performance targets and to demonstrate our compliance.
1.3 Scope and Exceptions:
To ensure that we fulfil our commitment to do the right thing, the adoption and incorporation of this policy into business practices is mandatory for all of our people. There are no exceptions to this policy.
1.4 Roles and Responsibilities:
All our people are responsible for complying with this policy and for taking any other steps which are appropriate to ensure compliance with data protection legislation.
The Group General Counsel and the Board will review the adequacy of this policy and the measures in place across the business annually, or as frequently as it is considered appropriate in light of any specific circumstances.
Our Policies:
