ALREADY DONE
Data Protection Complaints Procedure
Version
1.0
Effective date
18 June 2026
Owner
Sally Hansen, Already Done
Review date
June 2027
Contact
1. Purpose
This procedure explains how Already Done handles complaints from individuals about the way their personal data has been collected, used, stored, or shared. It meets the requirement introduced by the Data (Use and Access) Act 2025, which came into force on 19 June 2026, for all organisations that process personal data to have a formal complaints process in place.
Already Done is committed to handling personal data responsibly and to resolving any concerns quickly and fairly.
2. Who This Applies To
This procedure applies to any individual whose personal data Already Done processes, including:
• Current, past and prospective clients
• Website visitors (www.alreadydone.co.uk)
• Email subscribers and newsletter contacts
• Associates or contractors working with Already Done
3. What Counts as a Data Protection Complaint
A data protection complaint is any concern raised by an individual about how their personal data has been handled. This includes:
• Personal data being collected without a clear lawful basis
• Data being used in a way the individual did not expect or consent to
• A refusal or failure to respond to a Subject Access Request (SAR)
• Personal data being shared with a third party without permission
• Personal data being inaccurate and not corrected
• A concern that personal data has been lost, accessed without authorisation, or breached
• A request to delete personal data that has not been actioned
4. How to Raise a Complaint
Complaints can be submitted by email, letter or verbally. Written complaints (email or letter) are preferred as they create a clear record for both parties.
Subject line
Data Protection Complaint
Post
Sally Hansen, Already Done (address provided on request)
Verbally
Raised in a call or meeting — Sally will confirm receipt in writing within 5 working days
To help resolve your complaint as quickly as possible, please include:
• Your name and contact details
• A description of your concern
• The outcome you are hoping for
• Any relevant dates or reference numbers if known
5. How Complaints Are Handled
Step 1 — Acknowledgement (within 30 days)
All complaints will be acknowledged in writing within 30 calendar days of receipt. The acknowledgement will confirm:
• That the complaint has been received
• The name of the person handling it (Sally Hansen)
• The expected timeline for a full response
Step 2 — Investigation
Sally will review the complaint and investigate what has happened. This may involve:
• Reviewing any data held relating to the complainant
• Checking what consents or lawful bases were in place
• Speaking with any associate involved, if relevant
Step 3 — Full response (without undue delay)
A full written response will be provided as soon as reasonably possible after the investigation is complete. The response will:
• Explain what was found
• Set out any action being taken to resolve the complaint
• Explain the outcome clearly
If the complaint is complex or requires more time, the complainant will be kept informed of progress.
6. If You Are Not Satisfied
If you are unhappy with the response you receive, or if your complaint has not been resolved within a reasonable timeframe, you have the right to escalate to the UK’s data protection regulator:
Regulator
Information Commissioner’s Office (ICO)
Website
Phone
0303 123 1113
Post
Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, SK9 5AF
The ICO generally expects individuals to raise a complaint with the organisation first before contacting them directly.
7. Record-Keeping
Already Done will maintain a simple log of all data protection complaints received. The log will record:
• Date complaint received
• Summary of the complaint
• Date acknowledged
• Actions taken
• Date and outcome of full response
This log is kept securely and reviewed periodically. It will not be shared except where required by law or the ICO.
8. Review
This procedure will be reviewed annually or whenever there is a significant change in data protection law or in how Already Done operates. The next scheduled review is June 2027.
Already Done — www.alreadydone.co.uk
This document is version 1.0, effective 18 June 2026.