Data protection complaints

Related links:

• General complaints procedure
• Understanding GDPR and your data rights
• EEA and EU representative for data protection queries

How do I make a data protection complaint?

Anyone can make a data protection complaint about the College. If you have a complaint, please contact us first so that we can try and resolve the issue.

The best way to submit a data protection complaint to us is on our data protection complaints form. You can also email information.governance@rcpch.ac.uk. When you use one of these methods, we can respond to you efficiently and securely. 

If you wish, you can make a complaint by other means, such as by phone or by social media. As social media is not a very secure communication method, we will request an alternative method to contact you, such as email address.

Note: If your complaint does not relate to the processing of your personal data, but is rather a different complaint about the College, please follow the central complaints procedure.

Can I make a complaint on behalf of someone else?

If you wish to make a data protection complaint on behalf of someone else, you will need to provide evidence of written authorisation that you can act on behalf of the individual. This may be a a Power of Attorney or signed letter of authority. You can upload this evidence to the data protection complaints form.

We may seek further information to verify your entitlement to act on behalf of the individual. 

Can children and young people make a data protection complaint?

Children and young people (CYP) can make a data protection complaint to us.

If a CYP makes a complaint, we will undertake an assessment of their capacity to understand and exercise their rights. We may seek an external opinion, and the CYP will be informed of this beforehand. We will explain this process to the CYP, including who will be involved and why. 

Depending on the outcome of the assessment, we may ask a parent, guardian or carer to make the request on behalf of the CYP, or to provide support as necessary. 

Can I make a complaint on behalf of a child or young person?

If you wish to make a data protection complaint on behalf of a child or young person (CYP), we will consider whether it is appropriate to directly correspond with the CYP and/or representative, taking into consideration the best interests of the CYP.

We will also ask you to verify your relationship to the child or to provide authorisation, for example by providing a copy of a birth certificate. 

What happens after I submit a complaint?

Your complaint will be handled by the RCPCH Information Governance team who will acknowledge your complaint within 30 days. The following steps will then be taken:

• We may ask you for identification if we need to verify who you are - this is so that we make sure we are giving any personal data to the right person.
• We may ask you to provide more information to help us investigate the complaint.
• We will carry out an investigation into your complaint.
• We will keep you informed of the process, and let you know if there are likely to be any delays.
• We will inform you of the outcome of the complaint, usually via email unless requested otherwise. 

Who will manage my complaint?

The complaint will generally be managed by the college's Data Protection Officer supported by the Information Governance team and overseen by the college's Senior Information Risk Officer (SIRO). If the complaint is about the Data Protection Officer, the SIRO will manage the complaint. 

Information relating to the complaint will only be shared internally and with external bodies in the following circumstances:

• Where necessary to satisfactorily investigate the complaint
• If there is a concern, such as a safeguarding concern
• Where we are legally required to - for example informing the Charity Commission of the complaint.

When will the College refuse to handle a complaint?

In very limited circumstances, we may refuse to handle a complaint. For example, if we are not able to verify the identification of the requestor, or the authority for a third party to act on behalf of an individual. We may also refuse to handle a complaint where it is considered manifestly unfounded, abusive, vexatious or excessive. 

Even if we are unable to investigate the complaint, we will respond to you to let you know why. 

What can I do if I am not satisfied with the outcome of the complaint?

If you are not happy with the outcome of the complaint investigation, you can request that we review our decision.

If you wish to request a review, please email information.governance@rcpch.ac.uk within one month of receiving the outcome of the original complaint.

The complaint will be reviewed by the Senior Information Risk Owner (SIRO) if this has not previously occurred. If you do not agree with the outcome of the review by the SIRO, you can request a further review by the CEO. This must be requested via email to complaints@rcpch.ac.uk  within one month of receiving the outcome of the review by the SIRO. This will then be reviewed in line with our central complaints process.

The outcomes of reviews will be communicated via email, unless otherwise requested.

Is there an external review process?

Having gone through the internal College review process, explained above, if you are still unhappy with the outcome of the complaint, you can contact the Information Commission.

How is my personal data used in a complaint?

We retain a log of complaints as well as documentation relating to your complaint in line with the College's retention schedules. We may also use data for internal anonymised reporting and to improve our complaints process.

To find out more about how and why your personal data is handled, please read the website privacy notice.

Go to data protection complaints form

Date last updated: March 2026