Data protection complaint
A data protection complaint is any expression of dissatisfaction about how the Council has handled an individual’s personal information. This includes concerns about how personal data has been collected, used, shared, stored, or protected against unauthorised access. A complaint may also relate to the handling of a subject access request or another individual rights request, or to concerns following a personal data breach affecting the individual.
If a concern appears to relate to personal data, even where the individual does not use data protection terminology or make reference to the Act, you should not investigate or respond directly.
The matter should be referred promptly to the Information Governance Unit information.compliance@edinburgh.gov.uk, with relevant background information such as the context, systems involved and any related correspondence.
IGU will log and triage the complaint, coordinate enquiries with relevant service areas, provide a response to the individual, ensure compliance with statutory duties and identify any learning or improvements to reduce information risks.