In your role as Electoral Registration Officer (ERO) and/or Returning Officer (RO), you may receive complaints where someone believes that you have infringed on their data protection rights.
The Data (Use and Access) Act 2025 introduced a statutory duty on data controllers to establish a process for the handling of complaints by data subjects regarding the use of personal data under the UK General Data Protection Act (GDPR) or Part 3 of the Data Protection Act 2018.1
Complaints can range from the way you have responded to a subject access request (SAR), security measures you have in place to store information, or how you have collected and used personal information, but must focus on the misuse of personal data and not simply be a complaint about service or some other grievance.
As a data controller you must provide them with a way to raise their complaint.2
This could be a form (digital or hard copy), email address, or electronic alternative and may be something other teams in your authority have in place and are able to assist with.
Once a complaint has been received you must acknowledge receipt within 30 days.3
You must then, without undue delay, take any appropriate steps to respond to the complainant and then inform the complainant of the outcome.4
You should keep records of:
when you receive the complaint
your acknowledgement
any relevant conversations or documents
the outcome of the complaint
any actions taken as a result of the complaint and subsequent investigation
If you have not already done so, you should speak to your council's data protection or information officer to support you with this process. You should also consider the detailed guidance on the ICO website, to help support you in meeting your duties when dealing with data protection complaints.