Guidance

Home Office data protection complaints process

Published 28 July 2026

How to complain

If you have a complaint or concern regarding the handling of your personal data by the Home Office, you can contact the Office of the Data Protection Officer (ODPO) to raise your concerns.

Please contact us by email at DPO@homeoffice.gov.uk

If you are unable to email, you can write to the address below but this may mean that the ODPO takes longer to reply.

Office of the DPO
Home Office
Peel Building
2 Marsham Street
London
SW1P 4DF

The Home Office ODPO also acts as data protection officer (DPO) for a number of Home Office sponsored arms’ length bodies. If so, our details will also be included on their specific privacy notices.

What to expect

The ODPO has an independent remit to hold the controller accountable for how it processes personal data. In complaints, our goal is to:

• make a finding about the controller’s compliance with data protection legislation
• where possible, help the controller to make it right, for example by mitigating a security breach or by resolving an individual rights request
• support lessons learned to drive improvement in compliance

On receipt of your complaint, we will:

• acknowledge receipt of your complaint within 1 week of receiving the required information
• provide you with a unique ODPO complaint reference number
• confirm the date by which we will aim to provide you with a response

We may also:

• request further information to help us determine whether it is appropriate to open a complaint investigation, if necessary
• if you are not the data subject, request confirmation of their authority for you to act on their behalf in this matter

If you are complaining about a breach of your individual rights, such as the delayed response to a subject access request (SAR), we will require evidence that you have first attempted to resolve the matter with the responsible business area.

The ODPO does not have access to Home Office systems. Our investigations rely on the information provided by complainants and by the responsible business areas in the Home Office.

Where possible, we will keep complainants updated on the progress of our enquiries. We may also request further information to aid our assessment.

We ask complainants to quote our reference number when sending follow-up emails during the course of our enquiries. We will try to respond to requests for updates wherever possible.

Our service level arrangement (SLA) for investigating data protection complaints is 90 calendar days from the date we receive sufficient information to open a complaint investigation.

The ODPO processes personal data obtained during data protection complaints under public task. This may include your own personal data and the personal data of other people named in the complaint. The types of personal data we process will vary according to the nature of the complaint and depending what information is provided by the complainant and the business areas we are investigating. We routinely process:

• name and contact information, usually email addresses, for the purposes of contacting you about your complaint, case and correspondence management
• case specific information that may be personal and/or special category data for the purposes of understanding the complaint you are making, identifying the right team to support our investigation and investigating your complaint

Data processed within the complaint investigation will be retained and deleted in line with our retention and disposal standards.

Potential outcomes

We should always tell you the outcome of our investigation, however the level of detail we disclose will depend on the circumstances of the case, taking into consideration security and data protection requirements.

Our conclusions are based on the civil standard of proof, which is the balance of probabilities. This means that we will determine, based on the information available to us, whether something is more likely than not to have happened. Our determinations will be based on a comparison of the evidence provided by the complainant and the controller.

The ODPO does not have enforcement powers and we do not set policy. We can however, where appropriate, make recommendations to the controller for improving its information handling practices. The aim of this is to improve the experience for data subjects in the future.

If our investigation concludes that a security breach has occurred, we will ensure that the breach is formally reported and logged on central Home Office records.

When we inform you of the outcome of your complaint, we should always tell you how you can complain to the Information Commissioner’s Office (ICO) if you are not satisfied with the outcome. If the ICO chooses to start an investigation, they will contact the ODPO and we will act as liaison between the regulator and the Home Office. If you choose to complain to the ICO while our complaint investigation is ongoing, we may prioritise responding to the ICO’s enquiries.

While the ODPO may advise the Home Office on matters which may relate to compensation, the matter of compensation itself is not dictated by the UK General Data Protection Regulation (UK GDPR) and is therefore outside the ODPO’s remit to consider or negotiate on behalf of the Home Office.

Our remit is exclusively data protection. If you raise other issues in your complaint which are outside our remit, where possible we will direct you to the relevant complaints process within the Home Office so that you can take those matters forward.