Individual rights
The right to complain / seek compensation
At a glance
- An individual has the right to complain to the Ombudsman about any perceived violation of the DPA.
- The Ombudsman may also investigate matters under the DPA on her own motion.
- An individual suffers damage due to a contravention of the DPA by a data controller may seek compensation in the courts.
In brief
- Who can complain to the Ombudsman?
- What can an individual complain about to the Ombudsman?
- Will the Ombudsman automatically investigate a complaint?
- How will the Ombudsman handle offences?
Who can complain to the Ombudsman?
An individual can complain on their own or someone else’s behalf.
If someone complains on behalf of another, they must provide written authorisation from the aggrieved person.
What can an individual complain about to the Ombudsman?
A complaint to the Ombudsman under the DPA has to relate to personal data processing that has not been or is not being carried out in compliance with the provisions of the DPA, or anything done pursuant to the DPA.
The complaint does not have to relate to the processing of the personal data of complainants themselves.
However, if someone is complaining on behalf of another, the complaint must relate to the processing of the personal data of the person on whose behalf the complaint is being made (“the aggrieved person”).
Will the Ombudsman automatically investigate a complaint?
The Ombudsman may investigate a complaint under the DPA or start an investigation on her own motion.
The Ombudsman may determine whether to conduct an investigation, or not, on the basis of (including):
- the extent to which the complaint appears to raise a matter of substance;
- any undue delay in making the complaint;
- whether the complaint is frivolous or vexatious; and
- whether the person making the complaint is entitled to make a subject access request under section 8.
How will the Ombudsman handle offences?
The Ombudsman will refer alleged offences to the Director of Public Prosecution for possible prosecution in the courts.
Relevant provisions
Data Protection Act (2021 Revision)
Section 43: Right to complain to the Ombudsman
Section 13: Compensation for failure to comply