Data Protection Complaints Policy

If you wish to raise a complaint about our handling and Processing of your Personal Data, privacy matters, your Data Subject rights, or our access to and use of your Personal Data, please refer to the procedure set out below.  Please note that if you are dissatisfied with any element of the Firm and/or our services, which is not related to your Personal Data, please refer to our Complaints Procedure.

If your complaint concerns both data protection issues and our service or fees, we will coordinate our response to avoid duplication. We may address the data protection elements under this Policy and the service or fees elements under our Client Complaints Procedure. Where appropriate, we will provide a single consolidated response explaining the outcome on each aspect and the relevant escalation routes.

You may use either route to contact us initially. We will ensure your complaint is directed to the appropriate process and will explain how it will be handled.

We are committed to responding to Data Protection Complaints in a way that is fair, thorough and timely, and to taking reasonable steps to put matters right where appropriate.

We handle Data Protection Complaints in line with our obligations under the Data (Use and Access) Act 2025.

Definitions

Data Protection Complaint: any expression of dissatisfaction relating to our handling or processing of personal data, privacy practices, data subject rights, or our access to and use of personal data.

Personal Data: any information relating to an identified or identifiable natural person.

Data Subject: an identified or identifiable natural person to whom Personal Data relates.

Processing: any operation performed on personal data, including collection, recording, organisation, structuring, storage, adaptation, alteration, retrieval, consultation, use, disclosure by transmission, dissemination, alignment, combination, restriction, erasure or destruction.

How to raise a complaint

You may first raise your concern with your usual contact at the Firm (for example, the responsible fee earner or supervising partner) if you prefer to do so informally. We will seek to resolve your concern quickly.

You may also raise a complaint directly with our Data Protection Leader, who is responsible for data protection at any time. Please provide your name, contact details, a clear description of your concern, relevant dates and any supporting information.

Data Protection Leader, Qaiser Khanzada, email Qaiser.Khanzada@riaabg.com, telephone 0207 299 6901.

There is no fee for making a Data Protection Complaint.

We will acknowledge receipt of your complaint and aim to provide a substantive written response within 30 days of receipt.

Our investigation

We will conduct a fair and proportionate investigation, which may include reviewing files and systems, speaking with relevant staff and considering our obligations under relevant legislation.  It may take us longer to investigate and resolve complaints which are complex, serious or which relate to multiple data protection issues. 

We may ask you for further information or evidence to help us understand and address your concerns.

We will provide you with a written outcome setting out findings, and, where appropriate, the steps we propose to take.  These may include remedial actions such as correcting or updating records, implementing additional safeguards, restricting processing, improving procedures or training or explaining why we consider our processing to be compliant.

Confidentiality and handling of Personal Data

We will handle any Personal Data provided in connection with your complaint securely and only for the purposes of receiving, investigating and resolving the complaint, meeting our legal and regulatory obligations, and maintaining appropriate records.

Access to complaint information will be limited to those who need to know it for the purposes described above. Where we need to disclose information to third parties (for example, our insurers, professional advisers, service providers, or regulators), we will do so only where necessary and with appropriate safeguards.

Record keeping

We will keep a record of your complaint, our investigation, correspondence and the outcome.

We will not retain personal data relating to complaints for longer than is necessary and will handle such records in accordance with our retention and data protection policies. At the end of the retention period, records will be securely deleted or anonymised.

Information Commissioner’s Office (ICO)

If you are not satisfied with our response or you prefer to do so, you may raise your concerns with the ICO.  The ICO’s contact details are:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
t: 0302 123 1113
w: www.ico.org.uk