Raising data protection concerns or complaints
The University is committed to handling personal data lawfully, fairly and transparently.
You have the right to complain about how the University has used your personal data if you are concerned that it may have breached the UK General Data Protection Regulation (“UK GDPR”), the Data Protection Act 2018 (“DPA 2018”), or the Privacy and Electronic Communications Regulations (“PECR”) (together, the “Data Protection legislation”).
This page explains how to raise a data protection concern or complaint, which includes making us aware of a potential, suspected or actual personal data breach. It explains how your report will be dealt with.
What is a data protection concern or complaint?
A data protection concern or complaint might relate to, for example:
- How your personal data has been collected or used
- Whether your data has been shared or accessed inappropriately
- Accuracy of personal data held about you
- Retention or deletion of personal data
- Access to your personal data – complaints about how requests have been handled
- Use of images, recordings or monitoring
- Security of personal data (personal data breach)
How to report a concern or complaint
You can report any concerns by submitting a Data Protection Incident and Concern form. This form will prompt you to provide the information we require. Alternatively, you can email [email protected] explaining:
- What happened and when?
- Have you raised this issue within USW already? If so, who have you spoken to?
- How has this affected you?
- What would resolve this matter for you?
How your report will be dealt with
Any actual or suspected personal data breaches will be dealt with in accordance with the University Data Incident Procedure.
Other complaints and concerns will be promptly categorised accordingly and a decision will be made on the level of investigation required. Reports will be responded to without undue delay. If your complaint or concern is complicated it may take longer to investigate. If this proves to be the case you will be given an explanation as to why and when you can expect a response.
If a data protection complaint is submitted elsewhere within the University, it will be forwarded to the Information Compliance Team for investigation and response.
We reserve the right to decline complaints that are vexatious, frivolous, repetitive or made in bad faith.
Other forums or processes that may be more appropriate
Some matters may also be best reviewed in another forum or process, particularly if they are not directly relevant to Data Protection.
For complaints in relation to students: The Student Complaints Procedure may need to be followed.
If you are a USW colleague, sometimes the matter may be best dealt with by People and Organisational Development through the USW formal Grievance Procedure.
If we consider your concerns are best reviewed through these procedures, we will explain why we consider this is the case. If appropriate, we may forward the correspondence to the relevant department.
If you are not satisfied with our response
If you remain dissatisfied, you can escalate your complaint to the Information Commissioner’s Office (the “ICO”). Information about how to make a complaint to the ICO can be found here: www.ico.org.uk. The ICO will decide whether to investigate further and will contact the University should they have questions or queries.
How we may use the personal data you submit in your report
Your information will be used in accordance with our Privacy Notices and Data Protection Policy.
The University will collect data on incident and complaint outcomes and may use it for reporting and evaluation purposes and learning and development.
We may disclose your personal data to University colleagues, regulators or insurers for the purpose of dealing with your complaint, a complaint arising from it, or to implement any outcomes or actions from it.
We will not share your personal data with any other third parties without a valid lawful basis under Data Protection Law.