Skip to main content
HMRC internal manual

Complaint Handling Guidance

From:
HM Revenue & Customs
Published:
12 April 2016
Updated:
8 October 2026 - See all updates

CHG870 - Dealing with complaints: Complaints involving Data Protection Issues

Overview

Some complaints may include concerns about the way HMRC has handled an individual's personal information. These complaints can arise alongside a service complaint and may require advice from data protection specialists.

Examples include:

  • Disclosure of personal information to an unauthorised third party.
  • Misdirected correspondence containing personal data.
  • Loss of documents or information containing personal data.
  • Incorrect use, handling or sharing of personal information.
  • Alleged breaches of the UK GDPR or Data Protection Act 2018.

These complaints should be considered under normal complaints handling procedures while ensuring any data protection implications are identified and addressed.

Identifying Data Protection Issues

Complaint handlers should consider whether the customer is alleging that HMRC has:

  • Shared their personal information with someone who should not have received it.
  • Sent correspondence containing personal information to the wrong address.
  • Lost personal information.
  • Failed to adequately protect personal information.
  • Failed to comply with data protection legislation.

Where a complaint contains any of these elements, the data protection aspect should be considered separately from any wider complaint about service delivery.

Recording the Complaint

In line with CHART guidance, complaints must be recorded accurately to support complaint analysis, reporting and organisational learning.

Where a complaint includes a data protection issue, handlers should ensure the appropriate root cause is recorded. This applies regardless of whether the complaint is ultimately upheld.

Correct recording helps HMRC:

  • Understand the volume and nature of data protection-related complaints.
  • Identify trends and emerging risks.
  • Meet internal assurance and reporting requirements.
  • Support improvement activity across the department.

Examples may include complaints relating to:

  • Unauthorised disclosure of personal information.
  • Misdirected post containing personal data.
  • Missing correspondence where personal data may have been compromised.
  • Other failures in handling or protecting personal information.

Seeking Advice

Complaint handlers are not expected to determine whether a breach of data protection legislation has occurred.

Where there is uncertainty about:

  • Whether a data protection issue exists.
  • The impact of a potential personal data breach.
  • The appropriate response to the customer.
  • HMRC's obligations under UK GDPR or the Data Protection Act 2018.

Advice should be sought from the Office of the Data Protection Officer (oDPO) via advice.dpa@hmrc.gov.uk. Guidance on contacting the oDPO.

Potential Personal Data Breaches

Where the complaint identifies a potential personal data breach, staff must ensure the matter is reported through HMRC's established incident reporting procedures.

The existence of a complaint does not remove the requirement to follow normal incident reporting processes. Data breaches must be managed in line with HMRC's security and information management procedures.

Subject Access Requests and Freedom of Information Requests

Complaints about the handling of Subject Access Requests (SARs) or Freedom of Information (FOI) requests should continue to be dealt with in accordance with existing guidance in CHG865.

However, handlers should be aware that many data protection complaints arise outside SAR and FOI processes. For example, a complaint about misdirected post or disclosure of information to a third party may still require consideration as a data protection issue.

Responding to the Customer

When responding to complaints that include a data protection element:

  • Address the customer's complaint in line with normal complaints handling principles.
  • Explain any action taken to investigate the issue.
  • Seek specialist advice where necessary before reaching conclusions on data protection matters.

Avoid making definitive statements about whether a breach of data protection legislation has occurred unless this has been confirmed through the appropriate process.