Handling GDPR Complaints: A Guide for Employers

Managing personal data responsibly is critical for employers, and failing to comply can lead to big problems. If your business (be it large or small) hires staff, you will have a range of data protection law obligations. How you respond when employees or other data subjects raise complaints is critical. Your business should react appropriately and swiftly to avoid the complaint escalating into more serious risks. This article explores some possible complaints that staff may raise under data protection laws and some key practical action steps to help employers address complaints. 

What is the UK Data Protection Law Framework, and Why is Compliance Important?

The UK GDPR and the Data Protection Act 2018 set out key rules on how your employer business must handle personal data. 

As an employer, you may handle a range of staff personal information collected and processed throughout your working relationship. Data protection laws will apply to any data processing activities, such as personal information you collect or process during recruitment, performance management, managing absences, and other aspects of the employment relationship. 

Your employer’s business can demonstrate accountability and reduce risks by complying with data protection law rules. However, failing to meet these mandatory rules can lead to problems such as investigations, claims, and reputational damage. 

Why May Your Business Face Complaints?

You may face a complaint under data protection laws for various reasons. Your employees (like your individual customers) are data subjects who have rights under UK GDPR. Your employer business must take its staff-related data privacy obligations seriously to avoid risk. 

Specific complaints faced by employers may involve workplace-related data issues, such as complaints about transparency in monitoring practices or untimely responses to employee data subject rights requests.

Here are some examples of how poor data protection practices could result in complaints:

• if you receive a subject access request and your business fails to provide an employee’s requested data within strict legal timeframes and has no lawful reason for an extension of time, the delay could make the employee feel ignored, which may lead to complaints to the ICO;
• if your business implements processes to monitor employee emails without correctly informing them, employees may feel spied on or mistrusted. This lack of transparency could prompt formal complaints and even resignations;
• if your employer business suffers a data breach affecting employee data but fails to notify them, employees may view this as neglectful and undermining their data security. This failure can escalate into grievances, complaints and reputational harm; and
• if your employer business fails to protect sensitive employee health data and it becomes compromised in a breach, employees may lose trust, worry about misuse of their data, and raise formal complaints.

Such scenarios may raise complaints, which you should seek to address as soon as possible to avoid matters escalating and increasing risk for your business. 

How Should Employers Handle Complaints?

Handling complaints requires a direct, structured approach. Your business can consider the ICO’s guidance on complaint resolution as a helpful step-by-step guide and use it to help build your complaint resolution practices. Though this guidance is intended for small businesses, it can help your business see the steps the regulator would expect. Some key elements highlighted in the ICO’s suggested approach are set out below: 

Thorough investigations are essential when a complaint regarding data protection arises. Your business should carefully collect relevant details and identify any failures on your part. Clarifying concerns with the complainant can provide the information needed to understand the issue fully. 

GDPR Essentials Factsheet

This factsheet sets out how your business can become GDPR compliant.

Download Now

Communication

Your business should maintain regular communication throughout the process. Regularly updating the complainant demonstrates your commitment to resolving the issue and developing trust. Employers should also document their actions. Detailed records (including communications and decisions) can help provide evidence of compliance and support continuous improvement. This may also be particularly important should the employee escalate the complaint and the ICO investigate it. 

When responding to the complaint, your business should clearly explain the findings, address each concern, and explain how it resolved the issue. After determining the matter, your company should review lessons learned to improve processes and reduce the likelihood of similar complaints in the future. 

If the matter is not resolved and the complainant seeks to take further action, you may seek legal advice from a data protection solicitor regarding your options and position. For example, you may feel an employee is making unwarranted threats or claims you do not understand and need support addressing. 

How Can Employers Avoid Complaints?

Handling complaints can be highly stressful for an employer. It can be time-consuming and leave you with worries, such as whether the employee will raise a complaint to the ICO, which will cause an investigation and regulatory action, or tell their colleagues and cause concern about your practices, which could worry your staff. 

For employers, this may involve providing specific UK GDPR training for HR teams and implementing robust policies for handling employee information lawfully. Working with a data protection solicitor can help your business implement strong data protection policies and procedures to minimise the chance of complaints arising and help you understand how to tackle any complaints correctly. 

Key Takeaways

Handling data protection complaints effectively is critical for protecting your business. To give yourself a chance to stop complaints from escalating, your company should respond promptly, investigate thoroughly, and take clear action to resolve issues. If you feel a complaint is escalating and need support resolving it, you should seek legal advice from a data protection solicitor. 

If you need help with understanding your data protection obligations as an employer, our experienced data, privacy and IT lawyers can assist as part of our LegalVision membership. For a low monthly fee, you will have unlimited access to solicitors to answer your questions and draft and review your documents. Call us today on 0808 196 8584 or visit our membership page.

Frequently Asked Questions