We use cookies on this website to improve the experience we provide. By continuing to use our site you agree to this, or visit our cookie policy to manage your settings.
Saved courses
Search website

Data Protection Complaints Procedure and Form

Data Protection Complaints Procedure

This page explains the procedure for submitting complaints related to data protection including the handling of personal information. It also outlines how Birmingham City University will manage your complaint and what you can expect throughout the process.

1. Data Protection Complaints

Under the Data Use and Access Act 2025 (DUAA), individuals have the right to submit a complaint regarding data protection matters including the handling of their personal information by an organisation. The individual to whom the personal data relates to in relation to the complaint is referred to as the data subject. Complaints that fall outside the scope of this process will be redirected to the appropriate procedure, and the complainant will be informed of the rationale for that. For more information about this please refer to Section 4 Can the University Reject a Data Protection Complaint? You are welcome to read the Information Commission (IC) webpage for How to make a data protection complaint to an organisation.

2. The complaints process

Please complete BCU’s Data Protection Complaints Form, available via the Policies and Procedures page of the BCU website. Upon receipt of a completed complaints form, the Information Management team will review the complaint to determine whether it falls within the scope of the Data Protection Complaints Procedure. If the complaint is out of scope of this process, Section 4 of this process will be applied, and the complainant will be notified.

Once the completed complaint form has been received and, where necessary, the complainant’s identity has been verified, the University will acknowledge receipt of the complaint within 30 calendar days.

Additional information and/or supporting evidence may be requested from the complainant to assist the investigation.

Investigations and any resulting actions will be proportionate to the nature and complexity of the concerns raised. The information will only be accessible to relevant people who are involved in handling, advising on and reviewing the complaint.

Following completion of the complaints process, the complainant will be informed of the outcome and advised of any available next steps should they remain dissatisfied. A full response will be provided without undue delay.

3. How do I submit a Data Protection Complaint to Birmingham City University?

Individuals wishing to submit a formal complaint regarding data protection are required to complete the Data Protection Complaint Form in full. If you are unable to complete the complaints form due to accessibility reasons, BCU students should contact the Students’ Union for assistance, while complainants who are not BCU students can request support via emailing informationmanagement@bcu.ac.uk or by calling 0121 202 4597 for assistance.

All sections of this form must be completed to allow for proper assessment and response. Incomplete forms may result in delays in the investigation of the complaint.

The completed form should be submitted to the Information Management team via informationmanagement@bcu.ac.uk.

To ensure the protection of personal data, the University may take action to verify the identity of the complainant where appropriate. Acceptable forms of identification include a current BCU student or staff ID card, copy of a passport or a driving licence.

The complainant should usually be the data subject (the person whose personal data is the topic of the complaint). Complaints submitted by a representative on behalf of an individual will only be accepted if the University has received and accepted written consent, such as a signed form of authority, explicitly authorising the representative to act on the individual’s behalf in relation to the complaint.

To find out how BCU protects and processes personal data in relation to Data Protection Complaints, please read the Privacy Notice for Data Subject Rights Requests (including Data Protection Complaints).

4. Can the University reject a Data Protection Complaint?

We may refuse to handle the complaint or discontinue the complaints process if the complainant’s behaviour is deemed to be vexatious, malicious, manifestly unfounded, abusive, or excessive.

Examples of such behaviour may include (but are not limited to):

  • Seeking to raise further complaints about issues that have already been addressed under this Procedure.
  • Persistently seeking to raise complaints in response to situations where the complainant is given information or outcomes with which they do not agree.
  • Raising complaints with the intention of causing annoyance, disruption, or harassment, rather than raising legitimate concerns.
  • Raising complaints which appear to have no reasonable grounds and are not supported by any relevant evidence.

If the complaint is rejected, we will explain the reasons for refusal and provide the following options, which include:

  • Your right to make a complaint to the Information Commission (IC).
  • Your right to pursue your data subject rights through court.

5. Can the University reject a Data Protection Complaint?

Complaints submitted under this Data Protection Complaints process that fall outside its intended scope will be redirected to the appropriate procedure. For instance, complaints relating to Freedom of Information (FOI) requests should be pursued through the FOI Internal Review process via emailing FreedomOfInformation@bcu.ac.uk and reports of personal data breaches should be made using the Data Breach Reporting Procedure. Where a complaint is reassigned, the complainant will be informed of the rationale for this decision and directed to the appropriate process

6. What should I do if I am dissatisfied with the response I’ve received from my complaint?

If you require clarification regarding the response provided, please contact informationmanagement@bcu.ac.uk. The Information Commission (IC) provides some guidelines for this on their webpage ‘How to make a data protection complaint to an organisation’.

If you are dissatisfied with the handling of your complaint you can complain to the Information Commisson (IC). Please note the Information Commission may only consider your request once you have exhausted the University’s internal complaint process. If you are a member of staff and you receive an email (or equivalent) from a complainant expressing dissatisfaction with a complaint response they have received from BCU, please forward that to informationmanagement@bcu.ac.uk. If the complaint was verbal, please write it down and send it to informationmanagement@bcu.ac.uk.