Data protection complaint versus data rights request

What makes a message a complaint

A data protection complaint says, in substance, that the organisation may have mishandled personal data or failed to meet a data protection obligation. The person does not need to use the word complaint or complete a particular form.

Typical complaint points include excessive collection, unexpected sharing, poor security, inaccurate information, unfair use, failure to explain processing or dissatisfaction with the handling of an earlier request.

What makes a message a rights request

A data rights request asks the organisation to act on a right, such as access, rectification, erasure, restriction or objection. The wording may be informal. The organisation should consider what the person is actually asking it to do.

Rights requests have their own response rules under the UK GDPR and related legislation. The usual one-month framework and any permitted extension or identity question should be assessed under the correct rights-request procedure.

When the message contains both

A person might say that information was shared improperly and ask for a copy of everything the organisation holds. The first point is a complaint. The second is a subject access request. Treating the whole message as only one route creates a risk that the other obligation is missed.

Open two linked records. Preserve the same first receipt date, but calculate and manage each deadline under its own rule set. Cross-reference the records so staff can coordinate communications and avoid asking the person for the same information twice.

A practical triage record

The intake record should capture the person’s own words before reducing them to legal categories. Record the complaint points, requested outcome, any explicit right, representative details, relevant dates and communication needs.

If the classification is uncertain, record that uncertainty and obtain appropriate review. The purpose of triage is to route the work, not to decide whether the complaint is well founded.

• What does the person say went wrong?
• What do they want the organisation to do?
• Are they asking for access, correction, deletion or another right?
• Is a representative acting for them, and is authority clear?
• Is there urgent harm, safeguarding or another escalation issue?
• Which records and deadlines need to be opened?

Communicate as one organisation

Separate records do not require confusing duplicate correspondence. Acknowledgements can explain that the organisation has identified both a complaint and a rights request, name the relevant contacts and set out the distinct next steps.

The underlying evidence should still show which action belongs to which obligation. That distinction helps prevent a complaint progress update from being mistaken for a rights-request response.