Section 165 — Data Protection Act 2018: Complaints by data subjects to the Commissioner

Complaints by data subjects to the Commissioner 165 1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

2 A data subject may make a complaint to the Commissioner if the data subject considers that, in connection with personal data relating to him or her, there is an infringement of the UK GDPR or Part 3 or 4 of this Act.

3 The Commissioner must facilitate the making of complaints under subsection (2) by taking steps such as providing a complaint form which can be completed electronically and by other means.

4 If the Commissioner receives a complaint under subsection (2), the Commissioner must—

a take appropriate steps to respond to the complaint, b inform the complainant of the outcome of the complaint, c inform the complainant of the rights under section 166, and d if asked to do so by the complainant, provide the complainant with further information about how to pursue the complaint.

5 The reference in subsection (4)(a) to taking appropriate steps in response to a complaint includes—

a investigating the subject matter of the complaint, to the extent appropriate, and b informing the complainant about progress on the complaint, including about whether further investigation or co-ordination with a foreign designated authority is necessary. 6 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

7 In this section— “ foreign designated authority ” means an authority designated for the purposes of Article 13 of the Data Protection Convention by a party, other than the United Kingdom, which is bound by that Convention; ...