Making a data protection complaint

Under data protection legislation an individual has the right to submit a data protection complaint to an organisation.

Examples of when you might wish to complain are:

  • Because you are not satisfied with the response you have received following a subject access request or other data protection rights request
  • Because you are concerned that your personal data has not been kept secure, for example following a personal data breach
  • Because you think that an organisation has used, retained or disclosed your personal data in an inappropriate way

If you wish to make such a complaint to the University of Cambridge, you should contact the University’s independent Data Protection Officer (DPO): DPO@admin.cam.ac.uk 

The DPO will only consider data protection complaints.  Other complaints should be submitted through the normal University channels. The DPO does not consider data protection complaints about a College – each College is a separate legal entity and data controller and operates its own data protection complaints procedures.

While there is no fixed time limit for their submission, we encourage you to make data protection complaints in a timely fashion. We may be limited in the extent to which we can investigate historic complaints, or where there has been an excessive delay.  We also ask you to avoid using abusive or threatening language in your correspondence with us.

We have created a Data Protection Complaint Form for you to complete and email to DPO@admin.cam.ac.uk.  It is not mandatory to use this form.  However, if you submit your complaint by a different means such as a letter, please ensure you cover all the topics asked about in the form to enable us to look into your complaint properly and determine an outcome. 

 

 

You may be asked to provide further detail if your complaint is unclear or incomplete, or if further information is required to verify your identity.

Your complaint will be logged and acknowledged within 30 days of its receipt, though in all likelihood much sooner.  You are likely to be given a reference number at this stage.

The DPO will consider your complaint, usually with the assistance of staff in the Information Compliance Office.  When considering your complaint, input normally will be sought from the relevant individuals, teams or departments across the University.

You will be sent an outcome to your complaint without undue delay; this will explain the outcome reached.  Sometimes we will be able to send this soon after the complaint is acknowledged (or even at the same time).  On other occasions it may take longer and we will keep you informed if that is the case.

You also have the right of complaint to the Information Commissioner’s Office and the right to bring a court claim for compensation if you have suffered damage.

 

How we use your personal information to handle your data protection complaint


The Data Protection Officer and the staff of the Information Compliance Office will use your personal information to log, consider and answer your data protection complaint to the University, as well as to verify your identity.  We will liaise with colleagues internally as well as, where applicable and necessary, external advisors and/or third parties.  From time to time we analyse complaints to look for trends or collate statistics, and we may be required to report statistical information about our complaints to the ICO.  If you pursue your complaint to the ICO and/or the courts, we will share your information as necessary in answering regulatory enquiries and making submissions.

These uses of your personal information are necessary to fulfil our legal obligations and public interest tasks in handling such complaints.

For more information about how we handle your personal information, and your rights under data protection legislation, please see https://www.information-compliance.admin.cam.ac.uk/data-protection/general-data.  

 

Note on these procedures

The procedures for handling data protection complaints published on this webpage have applied since 19 June 2026, which is the date from which organisations had a legal obligation to consider and respond to data protection complaints. Prior to that date, data protection complaints were handled by the University's Information Compliance Office and/or its Data Protection Officer in line with previous ICO expectations as a matter of best practice.