Version 1.0. Effective from 1 September 2026
1. About this policy
Gordons Partnership is committed to handling personal data lawfully, fairly and transparently. This policy explains how individuals can raise concerns about our processing of personal data and how those concerns will be handled.
This policy is published in accordance with section 164A of the Data Protection Act 2018 and applies to complaints relating to the processing of personal data by Gordons Partnership where we act as a data controller. Complaints relating to processing where we act as a data processor will be passed to the relevant controller.
This policy does not apply to complaints about the quality of our legal services, fees or the conduct of a matter. Those issues are dealt with under our Client Complaints Procedure.
Where a complaint raises both data protection and service issues, the different aspects of the complaint may be handled under separate procedures. We will consider the substance of the concern and deal with it appropriately.
2. What is a data protection complaint?
A data protection complaint is any expression of concern or dissatisfaction about the way we have collected, used, stored, shared, retained or otherwise processed an individual’s personal data.
Requests to exercise data protection rights, such as subject access requests, are not normally treated as complaints. However, concerns about the way such requests have been handled will fall within this policy.
3. How to make a complaint
Complaints may be made:
- through the contact form on our website (please mark your message “Data protection complaint”);
- by email to dataprotection@gordonspartnership.com;
- by post to:
Data Privacy Manager
Gordons Partnership
First Floor
1 Chancery Lane
London WC2A 1LF
- by telephone on 020 7421 9421; or
- in person to any member of staff.
There is no charge for making a complaint.
Complaints may be made by a representative acting on behalf of an individual. We may ask for evidence of authority before disclosing personal information to that representative.
Reasonable adjustments will be made where required.
4. Acknowledgement and investigation
Complaints will be referred to the Data Privacy Manager, who is responsible for overseeing the investigation and response.
We will acknowledge receipt of a complaint as soon as reasonably practicable and in any event within 30 days of receipt.
The investigation undertaken will depend on the nature of the complaint. We may review relevant records, systems and correspondence, speak to members of staff involved and request further information where necessary.
Where there is reasonable doubt about a complainant’s identity, we may ask for information to verify it before discussing personal data.
5. Outcome
We aim to provide a substantive response within 30 days of receiving a complaint.
If additional time is required, for example because the issues are complex or involve third parties, we will keep the complainant informed and explain the reason for any delay.
Our response will state whether the complaint is upheld, explain our findings, any action taken or proposed and, where appropriate, any steps being taken to improve our practices or procedures.
If we identify a personal data breach or another compliance issue during the course of an investigation, we will take any action required by law or by our internal governance procedures.
6. Further review and regulatory complaints
If a complainant remains dissatisfied after receiving our response, they may request that we review our decision. We will arrange for a director not previously involved with investigating the complaint to do so within 30 days of receiving that request.
Individuals also have the right to complain to the Information Commissioner’s Office (“ICO”) although the ICO will generally expect the complaint to have been raised with us first.
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
Telephone: 0303 123 1113
Website: Make a complaint to the ICO
Nothing in this policy affects any right an individual may have to seek a remedy through the courts.
7. Record keeping
We keep records of data protection complaints and their outcome to help us monitor compliance, identify recurring issues and improve our processes. Complaint records are retained in accordance with our records management and retention policies.
8. Review of this policy
This policy is reviewed periodically and may be updated to reflect changes in law, regulatory guidance or our business activities.
