Skip to main content

Data Protection Complaints

What are data protection complaints?

You have the right to make a data protection complaint if you think the University has infringed data protection law because of the way we have used personal information about you. For example, you could complain if you are unhappy about:

  • The response you have received from the University to a data subject rights request you sent to us
  • The impact on you of a data breach affecting personal information held by the University.
  • How the University has collected or used personal information about you.

This right is separate from your right to make a complaint under the Complaint Handling Procedure, where a complaint is 'an expression of dissatisfaction by one or more our students, service users or members of the public about the University’s action or lack of action, or about the standard of service provided by or on behalf of the University.

How to make a data protection complaint

To make a data protection complaint, write to the University’s Data Protection Officer:

  • Use the subject line ‘Data protection complaint’
  • Provide:
    • Your full name. In some cases, we may need to ask you for proof of ID before we can respond
    • If you are a student or member of staff, your university username, and your student or staff number
    • If you are complaining on behalf of another person, please provide their full name and evidence that you have the authority to complain on their behalf
  • Describe the issue you are unhappy about:
    • Explain what happened, when it happened, and which teams or individuals were involved
    • If applicable, include any earlier case reference codes
  • The outcome or resolution you are looking for (optional).

Send your complaint by email to dataprotection@hw.ac.uk or by letter to:

Data Protection Officer, Information Governance, Heriot-Watt University, Edinburgh EH14 4AS

What we will do

We will acknowledge your complaint within 30 days.

Following our acknowledgement, we will investigate without undue delay. Whenever possible, the colleague investigating your complaint will not previously have been involved with the issue you are unhappy about.

Sometimes, we may need more information from you to fully investigate your complaint. In those cases, we will write to you and ask you to provide further information.

Before providing you with a full response, we may need to verify your identity. In which case, we will write to you with details of how to provide proof of your identity.

If our investigation takes more than 30 days, we will write to you with a progress update to keep you informed.

When we have completed our investigation, we will provide you with a full response setting out what we have done to resolve your complaint and, where appropriate, any action we have taken as a result.

Your right to contact the ICO

If you are still dissatisfied, you may complain to the Information Commissioner's Office (ICO). Guidance on how to make a complaint to the ICO is provided on their website at Make a complaint | ICO.