Data Protection Complaints Procedure

Evans & Jones Solicitors LLP

This procedure explains how you can raise a Data Protection Complaint if you are unhappy with how we have handled your personal information. It is separate from our service complaints process, which deals with concerns about the legal services we provide.

A data protection complaint may relate to issues such as how we have used your personal information, how long we have kept it, the accuracy of the information we hold, our response to a data rights request, or concerns arising from a data breach.

1. How to Make a Data Protection Complaint

You may make a complaint through any channel. You do not need to use a specific form.

You can contact us in any of the following ways:

Email: dalia.evans@evansandjones.co.uk
Post: 8B Station Rd, Radyr, Cardiff CF15 8AA
Telephone: 02920020909
In person: speak to your usual contact at the firm, who will pass your complaint to the appropriate person.

If you would like a copy of our Data Protection Complaints Form, please see below. If you need help making a complaint or require this procedure in an alternative format, please tell us.

> Data protection complaint form (Word doc)

2. What to Include in Your Complaint

Providing the following information will help us investigate your concerns efficiently:

Your name and contact details
How you are connected to the matter, for example client, former client or third party
What personal information you believe is affected
What happened and when
Why you are unhappy with how we handled your personal information
What outcome you are seeking
Any relevant reference numbers or correspondence

3. What Happens After You Complain

Your complaint will be passed to our Data Protection Supervisor (DPS), who is responsible for handling data protection complaints.

Acknowledgement

We will acknowledge your complaint within 30 days of receiving it.

Investigation

We will investigate your complaint without undue delay and may contact you if we need more information.

Identity Checks

To protect confidentiality, we may need to verify your identity before sharing information with you. We will not ask for more information than necessary and will not insist on ID where it would be unreasonable.

Requests for Clarification

If your complaint is unclear or very broad, we may ask you to clarify your concerns. Where clarification is requested, the response deadline may be paused until we receive the information needed.

4. Complaints Involving Children

If a complaint is made by a child or on their behalf, we will:

Communicate in clear, plain language appropriate to the child’s age
Assess the child’s capacity to understand and exercise their rights
Accept complaints from parents, guardians, advocates, charities or solicitors acting for the child

5. Our Response

Once our investigation is complete, we will write to you with:

The outcome of our investigation
Any steps we have taken or propose to take
Information about your right to escalate the matter to the ICO

We cannot refuse to accept a data protection complaint.

6. Escalating Your Complaint to the ICO

If you are unhappy with our response, or if we fail to respond within a reasonable time, you may escalate your complaint to the Information Commissioner’s Office (ICO).

Further information is available at: https://ico.org.uk/make-a-complaint/

We will inform you of your escalation rights in our written response.

7. How We Record and Use Complaint Information

We keep central records of all data protection complaints.

If required by the Secretary of State, we may need to report anonymised complaint data to the ICO.

8. Difference Between Data Protection Complaints and Service Complaints

A data protection complaint concerns how we handle your personal information.

A service complaint concerns dissatisfaction with the legal services we provide.

Service complaints are handled under our Complaints Procedure and by our Client Care Partner.