Data Protection Complaints Process

Catch22 reserves the right to amend this policy, following consultation, where appropriate.

Date of last review: June 2026

Date of next review: June 2028

Introduction

It is crucial that complaints regarding processing of both data and subject rights are handled with care and investigated through a standardized structured approach. Not only does this benefit service users, Catch22 Charity Limited, and all other stakeholders; it is a legal requirement enforced by changes to the UK General Data Protection Regulation enforced by the Data (Use and Access) Act 2025.

Under the UK General Data Protection Regulation, you have the right to raise data protection complaints with us. If you are unhappy with the outcome, you can then escalate to the Information Commissioner.

This complaints process is available to anyone whose personal data we process, not just individuals directly using our services.

You can complain about how we have collected, used, stored, or protected your personal data, or how we have handled your data protection rights.

How do I submit a complaint?

You have the right to submit a complaint through any route you decide. The route we recommend is through an email to DPO@catch-22.org.uk.

In addition to the routes above, we can receive complaints via letters to the address below or, where there is one, through the specific service you have been working with.

FAO: Data Protection Officer

27 Pear Tree Street

London

EC1V 3AG

You may submit a complaint through any method, including email, post, through our services, or by contacting directly. You do not need to use email specifically.

What should I include in a complaint?

To enable our investigation, we would need your name, contact details, description of the issue, and relevant dates and/or services involved.

If the information above is not included in your complaint, we will still accept it and investigate as thoroughly as possible taking into consideration the missing information.

There will be situations where we need to verify your identity before we can proceed with the investigation. In these situations, we will request identification and explain the reasons for the request. We will only request identification where necessary and will not request more information than is proportionate.

Your complaint does not need to include legal wording and can be made informally if required. If a complaint is submitted but not labelled as a complaint, it will still be treated as a complaint and subject to the process in this document.

If a complaint is being submitted by a representative of an individual, a form of authority must be provided.

What if there is a high risk associated with my complaint?

If there is a high risk associated with your complaint, example being safeguarding concerns or threat to someone’s life, we will prioritise that complaint and raise the risk with senior internal risk management staff including relevant subject matter experts.

What to expect atfer you have submitted a complaint

Upon receiving a complaint, we will document the complaint on our complaint log, and we aim to send an acknowledgement of your complaint within . We aim to provide a response within 28 days of acknowledgement, but this is not always possible. Where there is a delay in the process, we will ensure you are updated.

If investigation of your complaint will result in disclosure or contain information about sensitive information we hold, we will need to verify your identity before proceeding with the complaint.

What process does Catch22 follow?

The full process for handling your complaint is as below:

Acknowledge and Log your complaint
Assess the complaint
Investigate the complaint
Respond to the complaint
Record the complaint

Complaints are handled fairly, impartially, and objectively. Where the complaint relates to a child or vulnerable individual, we will ensure the process is handled in an appropriate and accessible way.

We maintain a record of all complaints, including details of the complaint, actions taken, outcomes, and any remedial steps implemented.

What will the outcome include?

Outcome responses to any complaint will, at a minimum, include:

What was investigated
What information was considered
Our decision
The reasons for the decision
Any remedial action to be completed
Your right to escalate further to the Information Commissioner

What should I do if I disagree with the outcome?

The next step would be for you to escalate your complaint to the Information Commissioner who will then discuss your complaint with us, identify what steps were taken, review the outcome, and potentially investigate further themselves.

You have the right to complain under the UK General Data Protection Regulation to the Information Commissioner’s Office (ICO), who are the UK’s independent data protection regulator.

You can contact the Information Commissioner using the telephone number or website below:

Telephone: 0303 123 1113

Website: https://ico.org.uk/make-a-complaint/