Data Protection Complaints Procedure 

Effective from	19 June 2026
Applies to	All personal data for which Andrew Smith Bookkeeping Services Limited (ASBK) is the data controller
Owner	Director / AML Officer
Review	Annually, or sooner if the law or our processes change
Version	1.0 — draft for review

 1. Purpose 

From 19 June 2026, section 164A of the Data Protection Act 2018 (inserted by the Data (Use and Access) Act 2025) requires every data controller to operate a process for handling complaints from individuals about the use of their personal data. This procedure sets out how Andrew Smith Bookkeeping Services Limited (“ASBK”, “we”) meets that duty. 

It explains how someone can complain to us about a data protection matter, how we will handle that complaint, and the timescales we work to. 

2. Scope — when this procedure applies 

This procedure covers complaints about personal data for which ASBK is the data controller. That includes, for example, the personal contact data of our clients and their owners, our own staff and contractor data, enquiry and marketing data, and CCTV or website data where applicable. 

Important distinction — client payroll and similar data. For much of the work we do for clients (for example, running payroll), ASBK acts as a data processor, and the client is the data controller. If a complaint relates to that data — for instance, an employee of a client querying their payroll records — the legal duty to handle the complaint sits with the client as controller. In those cases, we will acknowledge the contact, explain that the client is the controller, and promptly pass the matter to the client while supporting them as their processor. We still log the contact. 

3. How to make a complaint 

Anyone can make a data protection complaint to us using any of the routes below. We provide an electronic route and at least one alternative, as required by law. 

• Online: complete the data protection complaint form on our website (or request the form by email). 

• Email: data@asbkmail.co.uk. 

• Post: Data Protection Complaints, Andrew Smith Bookkeeping Services Limited, [insert practice postal address]. 

A complaint does not need to use any particular words or form. Any communication expressing dissatisfaction with how we have handled someone’s personal data will be treated as a complaint under this procedure. 

4. What we do with a complaint 

We handle every data protection complaint through the following steps. 

Step	What happens	Timeframe
1. Receipt	Complaint arrives by form, email or post. It is logged in the Data Protection Complaints Log and flagged to the AML Officer / Director.	Same day or next working day
2. Acknowledgement	We send the complainant a written acknowledgement confirming that we have received the complaint and are looking into it.	Within 30 days of receipt (the count starts the day after receipt and includes weekends and bank holidays)
3. Investigation	We review what happened, what personal data is involved, and whether anything has gone wrong. We may ask the complainant for more detail.	Without undue delay
4. Outcome	We tell the complainant the outcome of our investigation, any action taken, and how they can escalate to the ICO if they remain dissatisfied.	Without undue delay once the investigation concludes
5. Close & record	The outcome and date are recorded in the log. Any lessons are noted to prevent recurrence.	On conclusion

Acknowledgement deadline. We acknowledge every complaint within 30 days of receiving it. The 30-day period starts the day after the complaint reaches us and includes weekends and bank holidays. We then investigate and respond without undue delay. 

5. Escalation to the ICO 

We ask people to complain to us first, so we have the chance to put things right. If a complainant is unhappy with our response, or we do not respond in good time, they can complain to the Information Commissioner’s Office (ICO), the UK’s data protection regulator: 

• Website: ico.org.uk/make-a-complaint 

• Helpline: 0303 123 1113 

• Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF 

6. Records and responsibilities 

Every complaint is recorded in our Data Protection Complaints Log, including the date received, the date acknowledged, the outcome and the date closed. We keep these records to demonstrate compliance and to spot any recurring issues. 

The Director / AML Officer is responsible for implementing this procedure, meeting deadlines, and ensuring that staff and contractors know how to recognise a data protection complaint and pass it on without delay. 

How to complain 

If you have any concerns about how Andrew Smith Bookkeeping Services Limited handles your personal data, please let us know so we can put it right. You can contact us by email at data@asbkmail.com, by using the data protection complaint form on our website, or by post to Data Protection Complaints, Andrew Smith Bookkeeping Services Limited, [insert practice postal address]. We will acknowledge your complaint within 30 days and respond as quickly as we can. 

If you are not satisfied with our response, you can complain to the Information Commissioner’s Office (ICO) at ico.org.uk/make-a-complaint or on 0303 123 1113. We would, however, appreciate the chance to address your concerns first.