Summary

  • The policy explains how SME Solicitors handles complaints about its use of personal data.
  • It applies to clients, former clients, employees, applicants, suppliers, contractors and other individuals whose data the firm processes.
  • Complaints may concern unauthorised disclosure, inaccurate data, access-request delays, excessive retention, security breaches, marketing or other unlawful processing.
  • Complaints can be made to Guy Salter by email, post or telephone, either verbally or in writing.
  • The firm’s Data Protection Lead, Guy Salter, oversees complaints; Ian Stirzaker or another senior staff member will handle complaints involving him.
  • Complaints will normally be acknowledged within 10 working days.
  • The firm aims to provide a full response within one calendar month, although complex cases may take up to two additional months.
  • Investigations may involve reviewing records, speaking with staff, assessing legal compliance and identifying corrective action.
  • Remedies may include correcting or deleting information, restricting processing, staff training and improving policies or security measures.
  • The firm keeps records of complaints, findings, actions and recommendations in line with its retention policy.
  • Complainants who remain dissatisfied can escalate their concerns to the Information Commissioner’s Office (ICO).
  • Staff must cooperate with investigations, report complaints promptly and complete mandatory data-protection training.
  • The policy will be reviewed annually or sooner when legal, regulatory or organisational changes require it.

Back to Our Policies

Jump to section

  1. Purpose
  2. Legal Framework
  3. Scope of Complaints
  4. Making Complaint
  5. Responsibility for handling complaints
  6. Remedial Action
  7. Record Keeping
  8. Escalation to the Information Commissioner's Office (ICO)
  9. Staff Responsibilities
  10. Monitoring and Review
  11. Review and Links

1. Purpose

This policy sets out how SME Solicitors handles complaints relating to the processing of personal data. We are committed to protecting personal information and ensuring that all complaints concerning Data Protection are handled fairly, promptly and transparently.

This policy applies to complaints made by clients, former clients, employees, applicants, suppliers, contractors and any other individuals whose personal data is processed by the Firm.

This policy is designed to comply with:-

  • UK General Data Protection Regulation (UKGDPR).
  • Data Protection Act 2018.
  • Privacy and Electronic Communications Regulations (PECR), where applicable.
  • Solicitors Regulation Authority (SRA) requirements relating to confidentiality and information governance.

3. Scope of Complaints

A Data Protection complaint may relate to:-

  • Unauthorised disclosure of personal information.
  • Inaccurate personal data.
  • Failure to respond to a Data Subject Access Request.
  • Excessive collection or retention of personal data.
  • Inappropriate use of personal information.
  • Security breaches involving personal data.
  • Marketing communications.
  • Concerns regarding lawful processing.
  • Failure to comply with the firm’s Privacy Notice.

4. Making Complaint

Complaints may be submitted:-

  • By email: guy.salter@smesolicitors.co.uk
  • By post: Guy Salter, SME Solicitors, 8 Sansome Walk, Worcester, WR1 1LW
  • By telephone: 01905 723561

To help us investigate, complainants should provide:-

  • Their name and contact details.
  • Details of the complaint.
  • Relevant dates.
  • Copies of any supporting documents or correspondence.

Complaints may be made verbally or in writing although complaints made in writing are likely to be able to be dealt with more efficiently.

5. Responsibility for handling complaints

The Firm’s Data Protection Lead is responsible for overseeing the handling of Data Protection complaints.

Data Protection Lead: Guy Salter, Senior Partner

Contact Details: guy.salter@smesolicitors.co.uk

If the complaint concerns the Data Protection Lead, it will be handled by the Deputy Data Protection Lead, Ian Stirzaker or another senior member of staff.

Complaint Handling Procedure

Stage 1: Acknowledgement

The Firm will acknowledge receipt within 10 working days.

The acknowledgement will:-

  • Confirm receipt of the complaint.
  • Explain the investigation process.
  • Provide a contact point for further queries.

Stage 2: Investigation

The appointed investigator will:-

  • Review the complaint and relevant records.
  • Speak to the relevant staff members where necessary.
  • Assess compliance with applicable Data Protection laws and the policies of the Firm.
  • Consider whether any remedial action is required.

The firm may contact the complainant for additional information if necessary.

Stage 3: Response

The Firm aims to provide a substantive response within one calendar month of receiving the complaint.

Where a complaint is particularly complex, this period may be extended by up to a further two months. If an extension is required, the complainant will be informed and provided with reasons.

The response will include:-

  • The outcome of the investigation.
  • Any findings made.
  • Steps taken or opposed.
  • Information regarding escalation rights.

6. Remedial Action

Where a complaint is upheld, the Firm will take appropriate corrective action, which may include:-

  • Correcting inaccurate information.
  • Restricting or ceasing certain processing activities.
  • Deleting information where appropriate.
  • Providing additional staff training.
  • Reviewing policies and procedures.
  • Implementing technical or organisational improvements.

Where a personal data breach has occurred, the matter will be investigated and dealt with independently by the Firm’s Data Protection Lead.

7. Record Keeping

The Firm will maintain a record of:-

  • Complaints received.
  • Investigation findings.
  • Correspondence
  • Actions taken.
  • Recommendations for any future improvements.

Records will be retained in accordance with the Firm’s Data Retention Policy and applicable legal obligations.

8. Escalation to the Information Commissioner’s Office (ICO)

If a complainant remains dissatisfied after receiving the Firm’s final response, they may raise their concerns with the ICO. The address for the ICO is:-

Information Commissioner’s Office

Wycliffe House

Water Lane

Wilmslow

Cheshire

SK9 5AF

Website: https://www.ico.org.uk

Telephone: 0303 123 1113.

The ICO generally expects individuals to give organisations an opportunity to address concerns before contacting it.

9. Staff Responsibilities

All staff must:-

  • Comply with Data Protection legislation and the firm’s policies.
  • Co-operate fully with complaint investigations.
  • Report complaints promptly to the Data Protection Lead.
  • Undertake mandatory Data Protection training.

Failure to comply with this policy may result in disciplinary action.

10. Monitoring and Review

This Policy will be reviewed annually or sooner if required due to:-

  • Changes in legislation.
  • Regulatory Guidance.
  • Organisational changes.
  • Findings and complaints, audits or security incidents.

SME Solicitors does not currently appoint a statutory Data Protection Officer unless required by law. Responsibility for Data Protection Compliance rests with the Firm’s designated Data Protection Lead.

This policy was last reviewed on 25/09/2026.

Back to Policies   Contact us