Most disputes should end with the organisation. When they do not, the route depends on the regime and on what the person wants: a regulator’s view, compensation, or an order to comply.
Data protection
First, the organisation. Since 2026-06-19 controllersControllerDecides why and how personal data is processed. Carries most of the duties, and most of the penalties. must have a complaints process, acknowledge within 30 days and respond without undue delay (DPA 2018 s.164A). The regulator generally expects you to have complained to the organisation first.
Then the Information Commission. Anyone can complain about an infringement involving their data (Art 77). The Commission, which succeeded the Information Commissioner’s Office on 2026-09-30, decides what action to take. It is not a court and does not award compensation.
If the Commission does not progress a complaint, the person can apply to the First-tier Tribunal for an order requiring it to take appropriate steps (DPA 2018 s.166). That is about the handling of the complaint, not its merits.
Court. A person can bring a claim against a controller or processorProcessorProcesses personal data on a controller's instructions, such as a cloud host or payroll bureau, with its own security and breach duties. for compensation for material or non-material damage (Art 82, DPA 2018 s.168), and can apply for a compliance order (s.167). In England and Wales and Northern Ireland that is the High Court or county court; in Scotland the Court of Session or sheriff court.
Freedom of information and environmental information
| Stage | FOIA 2000 and EIR 2004 | FOISA 2002 and EIRS 2004 |
|---|---|---|
| Review | Internal review by the authority | Requirement for review, answered in 20 working days |
| Regulator | Information CommissionInformation CommissionThe UK data protection and FOI regulator. A board-led body that succeeded the Information Commissioner (the ICO) on 2026-09-30, with the same role and powers. (decision notice) | Scottish Information Commissioner, within six months |
| Appeal | First-tier Tribunal (General Regulatory Chamber), then Upper Tribunal | Court of Session, on a point of law |
Electronic communications
PECR complaints go to the Information Commission. Nuisance calls are also reported through the Telephone Preference Service. People have a right to compensation for damage caused by a PECR contravention (PECR reg 30).
Criminal routes
Some failures are crimes: unlawfully obtaining personal dataPersonal dataAny information relating to an identified or identifiable living person, including identifiers and combinations of data that single someone out. (s.170), re-identification (s.171), destroying records to defeat an access or FOI request (DPA s.173, FOIA s.77, FOISA s.65, EIR and EIRS reg 19). Report them to the Information Commission, or in Scotland to the police or the Procurator Fiscal.
Choosing a route
- Want the organisation to fix it? Complaint, then the regulator.
- Want compensation? A court claim; the regulator cannot award it.
- Want information released? The FOI or EIR route for the relevant nation.
- Think a crime was committed? Report it.