We take data protection seriously.
Last updated: 07/07/2026
Utopia Furniture limited (UFL) take our legal obligations under the UK General Data Protection Regulations very seriously. We are committed to provide a professional and effective service to our customers and third parties who may be affected by our data processing activities and strive to investigate complaints in a prompt and effective manner and in accordance to the Data Protection Laws.
The purpose of this policy
Is to ensure everyone is aware of their rights under the Data Use and Access Act 2025 (DUAA) implemented 19th June 2026. It enables the individual/company to understand what process/procedure should be followed if they believe their data protection rights have been breached. Whilst the Information Commissioners Office (ICO) has issued the introduction of the new ‘recognised legitimate interest legal basis for processing personal data’; we will look to follow their guidelines on the procedure for handling of complaints. This policy is extended to any third party-end consumer whose data we may hold for legitimate purposes.
Within this policy we will outline what an individual is required to do and who to inform if they believe a breach has occurred, therefore raising a formal complaint about the said breach. As with data subject access requests (DSAR), data protection complaints do not need to use legal terms or quote sections of the legislation in order for them to be treated as complaints under the Act.
Anyone who wishes to make a formal complaint can, if they wish to do so, complain via the ICO, who will then formally investigate.
Should the ICO be involved, they would record complaints to identify trends within the organisation.
What counts as a complaint is broad. The guidance makes it clear that any allegation by a data subject (or someone on their behalf) that a business has infringed data protection legislation because of the way their personal data has been handled will constitute a complaint.
Not all communications of dissatisfaction count as complaints...
The ICO guidance draws the distinction between complaints relating to infringements of data protection laws and complaints about other business areas that also involve the exercise of data protection rights, these are not considered to be complaints.
An example: a data subject acknowledging a DSAR was responded to on time but expressing dissatisfaction that the process was not expedited; or a general customer service complaint which includes a request to delete their information.
Example of potential breach's / infringement
- Release of data to anyone without consent.
- The way in which an organisation responds to an individual data subject access request (DSAR) or any other subject rights.
- Security measures used to store an individual’s personal data, if affected by a data breach.
- If an organisation has collected or used an individual’s personal data without consent.
(this list is used as an example and therefore is not exhaustive)
Complaints Procedure
The recipient of the complaint must reply stating the complaint will be forwarded to the Head of IT, who will follow due process, which will involve acknowledging the complaint and where possible investigate the complaint within 30 days of the original receipt.
- Appropriate steps will be taken to ensure a full investigation and response to the complaint is undertaken without undue delay. The guidelines via the ICO clarifies this as ‘without unjustifiable or excessive delay’.
- We must keep the complainant updated ‘without undue delay’ The guidelines state this practice as keeping the complainant up to date with timeframes, and explaining any delays, rather than informing them of each step taken so far in the investigation.
- A formal outcome in writing must be issued to the complainant.
If the outcome has been issued to the complainant within the 30-days period, a separate acknowledgement is not required.
During the investigation, we should look at the following, this would be aligned to the guidelines the ICO use.
- What was the breach?
- Has the data protection issue caused, or is likely to have caused a level of harm?
- Has the data protection issue significantly affected anyone, including people who need extra support to protect themselves or are likely to?
- Has the data protection issue had a significant impact on a substantial number of people, or is likely too? (an example would be where a policy or practice has negatively affected many people)
The ICO has issued guidance on what may not constitute a data protection complaint. This information is available from HR to assist in an investigation.
The business should tell the data subject:
- What steps have been taken to resolve the complaint.
- Where appropriate, what actions have been taken, because of the complaint
- Sufficient details for the data subject to be able to understand the rational, why the business believes it has complied with the applicable data protection legislation (assuming this is the case)
- Good practice would be to inform the complainant that they have a right to complain to the ICO, there would be no need for the business to inform the ICO, if the complaint is escalated, the ICO will reach out to the business if necessary.
The ICO guidance makes it clear that a record of the above steps should be kept by the business as the ICO may reference these actions.
Submit A Data Protection Complaint
We are sorry that you feel you need to make a formal complaint to us, we will endeavour to close this case as soon as possible with a satisfactory outcome for you.
This form is intended to help you submit a data protection complaint in a way that will enable us to investigate and deal with your complaint as quickly as possible. The form is optional if you prefer you can write or email us at the postal address or email below.
Our email address is: datacomplaints@utopiagroup.com
Our postal address: Utopia House, Springvale Business Park, Springvale Avenue, Bilston, Wolverhampton, West Midlands, WV14 0QL
Please mark for the attention of: Head of IT – Complaints
