Data Protection Complaints Procedure Policy

1. Purpose

Beyond Encryption is committed to protecting the personal data of its customers, staff, and other individuals, and to handling any concerns about how that data is used fairly, promptly, and transparently.

This policy sets out how Beyond Encryption receives, records, investigates, and responds to complaints relating to data protection, including concerns about how personal data has been collected, used, shared, secured, or retained. It also explains an individual's right to escalate a complaint to the Information Commissioner's Office (ICO) if they remain unsatisfied with our response.

 

2. Scope

This policy applies to all complaints about the processing of personal data made by:

• Customers and prospective customers

• Employees, contractors, and workers

• Suppliers and business partners

• Any other individual whose personal data Beyond Encryption processes.

It covers complaints received by any channel, including email, phone, post, or via our website, and applies to all staff, departments, and systems that process personal data on behalf of Beyond Encryption.

This policy does not cover general customer service complaints unrelated to data protection; those are handled under Beyond Encryption's standard customer complaints process. Where a complaint has both a data protection element and a general service element, this policy governs the data protection element.

 

3. Definitions

Personal data: any information relating to an identified or identifiable individual.

Data subject: the individual to whom personal data relates.

Data protection complaint: any expression of dissatisfaction, whether verbal or written, about how Beyond Encryption has collected, used, shared, secured, retained, or otherwise processed personal data, including complaints about the exercise of a data subject's rights under UK data protection law.

ICO: the Information Commissioner's Office, the UK's independent regulator for data protection.

UK GDPR: the UK General Data Protection Regulation, as it forms part of UK law, together with the Data Protection Act 2018.

 

4. Regulatory Framework

This policy is designed to support Beyond Encryption's compliance with:

• The UK General Data Protection Regulation (UK GDPR);

• The Data Protection Act 2018;

• The Privacy and Electronic Communications Regulations (PECR), where relevant;

• Any other applicable data protection law in the jurisdictions in which Beyond Encryption operates.

Individuals have the right to lodge a complaint with the ICO at any time. This policy does not replace or limit that right; it sets out how Beyond Encryption aims to resolve concerns directly wherever possible.

 

5. Roles and Responsibilities

Data, Compliance and Operations Manager: acts as the primary point of contact for data protection complaints, oversees investigations, approves final responses, and maintains the complaints log described in Section 9.

Plan Owner / CEO: is informed of any complaint that indicates a significant or systemic data protection failure, or any complaint escalated to the ICO.

All staff: must recognise when a communication constitutes a data protection complaint, even if the individual does not use that term, and pass it to the Data, Compliance and Operations Manager without delay.

Department managers: provide information and cooperate with any investigation relating to their team's handling of personal data.

 

6. Complaints Procedure

6.1 How to Raise a Complaint

A complaint about data protection may be raised by any individual using any of the following channels:

• Email to the Data, Compliance and Operations Manager (dpo@beyondencryption.com);

• In writing, addressed to Beyond Encryption's registered office: Beyond Encryption Limited, 1 Gloster Court, Whittle Avenue, Fareham, Hampshire, PO15 5SH;

• By telephone to Beyond Encryption's main office number: 020 8123 4546;

• Verbally to any member of staff, who must record and pass on the details.

Wherever possible, the individual should be asked to provide: their name and contact details, a description of their concern, any relevant dates or reference numbers, and their preferred outcome.

6.2 Acknowledgement

All data protection complaints will be acknowledged in writing within 5 working days of receipt. The acknowledgement will confirm who is handling the complaint and give an expected timescale for a full response.

6.3 Investigation

The Data, Compliance and Operations Manager will investigate the complaint, which may involve:

• Reviewing relevant systems, records, and communications

• Speaking with staff involved in the processing activity concerned

• Assessing whether any breach of UK GDPR, the Data Protection Act 2018, or internal policy has occurred

• Identifying any corrective or remedial action required.

Where the complaint indicates a possible personal data breach, the investigation will be conducted alongside, and in line with, Beyond Encryption's Data Breach Policy, including any applicable requirement to notify the ICO within 72 hours of becoming aware of a breach.

6.4 Response

Beyond Encryption aims to provide a full written response within 1 calendar month of receiving the complaint. Where a complaint is complex, this period may be extended by up to 2 further months; if so, the individual will be told the reason for the delay within the first month.

The response will set out: the findings of the investigation, whether the complaint is upheld in full, in part, or not upheld, any action taken or planned as a result, and the individual's right to escalate the matter to the ICO if they remain dissatisfied.

6.5 Internal Escalation

If the individual is not satisfied with the initial response, they may ask for the complaint to be reviewed by the CEO or a director not involved in the original investigation. This review will be completed within 20 working days and will result in a final written response from Beyond Encryption.

 

7. Right to Complain to the ICO

If an individual remains dissatisfied after completing Beyond Encryption's internal complaints procedure, or at any other time, they have the right to lodge a complaint directly with the Information Commissioner's Office:

• Website: ico.org.uk/make-a-complaint

• Telephone: 0303 123 1113

• Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.

Beyond Encryption will cooperate fully with any ICO enquiry or investigation arising from a complaint.

 

8. Recording and Reporting

Every data protection complaint, however received, will be logged using Form A (see Section 10), regardless of whether it is ultimately upheld. The log will record the date received, the nature of the complaint, the investigation outcome, and any corrective action taken.

The Data, Compliance and Operations Manager will report a summary of data protection complaints, including any trends or recurring issues, to the CEO at least annually as part of the wider data protection and information security review.

 

9. Confidentiality and Data Protection

Personal data collected during the handling of a complaint will be processed in line with Beyond Encryption's Privacy Policy and kept only for as long as necessary to resolve the complaint, respond to any related regulatory enquiry, and meet legal record-keeping obligations. Access to complaint records will be limited to those who need it to investigate or oversee the complaint.

 

10. Related Policies

• Data Protection Policy

• Data Breach Policy

• Privacy Policy

• Business Continuity Management Policy

• Information Security Policy

 

11. Training and Review

All staff receive an overview of this procedure as part of their induction and periodic data protection training, so that any complaint raised with them is recognised and passed on promptly.

This policy will be reviewed annually by the Data, Compliance and Operations Manager, or sooner if there is a significant change to data protection law, regulatory guidance, or Beyond Encryption's processing activities.

 

Revision History

 

Version 1.0 – August 2026

Owner: Data, Compliance and Operations Manager

Next Review: August 2027

Approved by: Paul Holland, CEO