Before it reaches the regulator.
WHY IT MATTERS
Most regulatory contact begins with an unresolved complaint.
WHAT TO PROVIDE
A clear route to complain.
WHERE
The privacy notice, and the site.
WHAT TO DO ON RECEIVING ONE
Acknowledge promptly Establish the facts Respond substantively
WHAT NOT TO DO
Treat it as an ordinary support ticket Respond defensively Delay
WHAT TO ESTABLISH
What they are actually complaining about.
WHAT COMMON COMPLAINTS ARE
Marketing after opting out A rights request ignored or refused Data shared without authority A breach handled poorly Inaccurate data not corrected
WHAT TO DO IF THEY ARE RIGHT
Say so, fix it, and explain what prevents recurrence.
WHY THAT USUALLY ENDS IT
Most people escalate because they were dismissed, not because of the original issue.
WHAT TO DO IF THEY ARE WRONG
Explain, with reference to what you actually did.
WHAT TO TELL THEM
That they may complain to the regulator.
WHY TELL THEM
It is usually required, and concealing it is worse.
WHAT TO RECORD
The complaint, the investigation, and the outcome.
WHAT TO REVIEW
Complaint themes, for systemic problems.
