You've emailed a company asking for your personal data. Maybe twice, maybe five times. They haven't responded, and your patience is gone. In the UK, you don't have to accept the silence — you can file a complaint with the Information Commissioner's Office (ICO), and they have real enforcement power.
Here's exactly how to do it, what to expect, and how to strengthen your case.
When You Can File an ICO Complaint
The ICO accepts complaints when:
- You've made a Subject Access Request (SAR) under GDPR or UK GDPR
- The company has failed to respond within 30 calendar days (or an extended 90 days if they notified you of a delay)
- The company has responded but refused your request without valid legal grounds
- A company has mishandled, lost, or improperly shared your personal data
You can complain about any organization that processes personal data of UK residents — including companies based outside the UK if they offered services to UK consumers.
Before You File: Build Your Case
The ICO is more likely to act if your complaint is well-documented. Before filing, gather:
Essential evidence:
- A copy of your original data access request (with date)
- Copies of all follow-up emails
- Any responses you received (even automated ones)
- Proof of how the company collected your data (account confirmation emails, screenshots)
Strengthening details:
- The company's privacy policy (screenshot it or save from the Wayback Machine)
- Company registration details from Companies House
- Any evidence the company is still operating or has a successor
- A timeline showing the total days since your request
Step-by-Step: Filing Your ICO Complaint
Step 1: Go to the ICO Complaint Portal
Visit ico.org.uk/make-a-complaint and select "Make a complaint about an organization."
Step 2: Describe the Issue
Select the category that best fits your situation:
| Situation | ICO Category |
|---|---|
| No response to data request | Subject Access Request |
| Refused to provide data | Right of Access |
| Won't delete your data | Right to Erasure |
| Data breach or misuse | Data Protection Breach |
Step 3: Provide Your Details
Fill in:
- Your name and contact information
- The organization's name, address, and any reference numbers
- A clear description of what happened, including dates
- What outcome you want (data provided, data deleted, investigation)
Step 4: Upload Evidence
Attach your emails, the original SAR, and any responses. The more documentation you provide upfront, the faster the ICO can act.
Step 5: Submit and Wait
The ICO typically acknowledges complaints within 5-10 business days. Their investigation process can take 30-90 days depending on complexity.
What the ICO Can Actually Do
The ICO has significant enforcement powers:
- Information notices: Legally compel the company to provide information
- Enforcement notices: Order the company to take specific actions (like releasing your data)
- Penalty notices: Fine companies up to £17.5 million or 4% of global annual turnover
- Criminal prosecution: In serious cases of deliberate misuse or obstruction
In practice, most companies comply once they receive ICO correspondence. The threat of investigation alone is often enough to get a response.
What If the Company Is Defunct?
Filing an ICO complaint against a company that no longer exists is still worthwhile because:
- The data is held by someone — a liquidator, successor, or data processor who is still subject to UK GDPR
- The ICO can investigate the data controller — whoever currently holds the data, regardless of whether the original company exists
- It creates a regulatory record — useful if the same directors start a new company
When filing, explain that the company has ceased operations and identify any successor or data processor you've found.
Timeline: What to Expect
| Stage | Typical Timeframe |
|---|---|
| ICO acknowledges complaint | 5-10 business days |
| ICO contacts the organization | 10-20 business days |
| Organization response deadline | 30 days from ICO contact |
| ICO decision / enforcement | 30-90 days total |
| Full resolution (complex cases) | 3-6 months |
Tips for a Stronger Complaint
- Be specific about dates. "I sent my request on March 3rd" is stronger than "a few weeks ago."
- Reference the law. Cite UK GDPR Article 15 (right of access) or Article 17 (right to erasure).
- Show persistence. Multiple follow-ups demonstrate good faith on your part.
- State the harm. Explain why the data matters — identity theft risk, financial exposure, emotional distress.
- Escalate gradually. The ICO expects you to have tried resolving the issue directly first.
How Pine Automates This Entire Process
Filing an ICO complaint is effective but time-consuming. You need to research the company, draft a proper SAR, follow up multiple times, document everything, and then file the complaint.
Pine handles all of this automatically. Pine drafts legally sound data access requests, sends persistent follow-ups on a schedule, escalates the tone over time from polite request to formal warning, and can guide you through the ICO complaint process if the company still won't comply. One user had Pine send 10 escalating emails over a month to a defunct company — the final email warned of an ICO complaint, and the company finally responded.
Sources
- ICO Complaints Process: https://ico.org.uk/make-a-complaint/
- UK GDPR Right of Access: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/right-of-access/
- ICO Enforcement Powers: https://ico.org.uk/action-weve-taken/enforcement/
How long does an ICO complaint take to resolve?
The ICO typically acknowledges complaints within 5 to 10 business days. The full investigation process usually takes 30 to 90 days, though complex cases involving defunct companies or international data transfers can take 3 to 6 months. The ICO gives the organization 30 days to respond once contacted.
Can I file an ICO complaint if the company no longer exists?
Yes. If the company has shut down, someone still controls your data — a liquidator, successor company, or data processor. The ICO can investigate whoever currently holds your personal data, regardless of whether the original company exists. Include any information about successors or liquidators in your complaint.
Do I need a lawyer to file an ICO complaint?
No. The ICO complaint process is free and designed for individuals to use without legal representation. You file online through ico.org.uk, describe the issue, upload evidence, and the ICO handles the investigation. However, for complex cases involving significant financial loss, consulting a data protection solicitor may help.
What evidence do I need for an ICO complaint?
At minimum, you need a copy of your original data access request with the date sent, copies of any follow-up emails, and details of how long the company has failed to respond. Strengthening evidence includes the company's privacy policy, Companies House registration details, automated response confirmations, and a clear timeline of all communications.
