BBC Data Protection Complaints Policy

Version 1

1. Purpose

The BBC is committed to protecting personal data and respecting individuals’ rights under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 (DPA 2018), the Data (Use and Access) Act 2025 (DUAA 2025) and the Privacy and Electronic Communications Regulations 2003 (PECR 2003).

This policy explains how individuals can raise a complaint about how the BBC has handled their personal data, and how those complaints will be managed in a fair, transparent, and timely manner. Individuals are encouraged to complete the BBC’s internal complaints process before escalating concerns to the Information Commissioner’s Office (ICO). 

2. Scope

This policy applies to anyone whose personal data is processed by the BBC Public Service where UK data protection law applies.

It covers complaints relating to:

• How your personal data is collected, used, shared or retained
• The accuracy of your personal data
• The security of your personal data
• Handling of your data subject rights request
• Subject Access Request Internal Reviews
• Delays or failures in responding to data subject rights requests
• Alleged breaches of data protection law
• Any other concerns about how personal data is handled

If your complaint relates to how your personal data is processed by BBC Studios, please refer to the BBC Studios Data Protection Complaints Policy.

What is out of scope:

• General service and/or editorial complaints not relating to personal data. Please see Contact the BBC for how to complaint to the BBC
• Freedom of Information (FOI) or Environmental Information Regulations (EIR) issues. These are handled by other departments in the BBC

The BBC may decline to take further action on complaints that are a duplication of an existing complaint or that are manifestly unfounded or excessive, taking into account the requirements of applicable data protection law.

3. Our Commitment

The BBC will:

• Treat all complaints seriously and respectfully
• Make it easy to raise a complaint through multiple channels
• Handle complaints promptly and fairly
• Keep complainants informed throughout the process
• Learn from complaints to improve our practices

4. How to Make a Data Protection Complaint

You can submit a complaint to the BBC through any of the following:

• Email
• Post
• Online form (where available)
• Phone via BBC Audience Services 

You do not need to use formal language. Any expression of dissatisfaction about how we have handled your personal data will be treated as a complaint.

Time limits for submitting a data protection complaint

• If you want to make a data protection complaint, then you should do so within three months of becoming aware of the issue. Section 5 Data Protection Complaints details this process.
  

• If you are unhappy about how we’ve responded to your subject access request (SAR), then you should do so within 40 working days. Section 6Subject Access Request (SAR) Internal Reviews details this process.

Waiting longer than these prescribed time limits could affect our ability to look into your complaint. In some cases, a long delay will mean that we will not consider the matter at all.

The BBC may still consider complaints submitted outside these time limits where there are extenuating circumstances and it is reasonable to do so. To ensure that serious concerns are not excluded solely because the time limit has expired, the BBC may consider older complaints where:

• there is an ongoing risk of harm to data subjects
• there are safeguarding concerns, for example where the complaint relates to the processing of children’s or vulnerable adults’ personal data
• there is evidence of a systemic failure

5. Data Protection Complaints

If you are concerned about how the BBC has handled your personal data, you can submit a data protection complaint. The BBC has a two-stage internal complaints process, followed by the right to complain to the UK data protection regulator, the Information Commissioner’s Office (ICO):

1. Initial review
2. Data Protection Officer review
3. ICO escalation

Stage 1: Initial Handling 

What happens:

• We acknowledge your complaint promptly and provide a reference number
• We review your complaint and may contact you for clarification
• We investigate by reviewing any records relating to your complaint and contacting relevant BBC teams
• We keep you updated at key stages
• We aim to respond as promptly as practicable and ordinarily within one month. More complex complaints may take longer 

There is likely to be a wide range of factors that influence how long your investigation takes. This can include the following:

• the complexity of the issue
• the scale of the issue
• any harm that the complainant is suffering as a result of an unresolved issue

The time it takes to investigate and complete your case is indicative and may change depending on the above.

The BBC uses a complaints case management system, and all complaints-related communications will be sent through this system.

The investigation:

The BBC is required to make reasonable and proportionate enquiries, having regard to the circumstances of each complaint.

We will investigate your concerns and assess compliance with all relevant data protection legislation and regulation (such as the UK GDPR, the DPA 2018, the DUAA 2025, and the PECR 2003), ICO guidance and BBC policies. 

The Outcome:

You will receive a written response explaining:

• what we found
• any actions taken
• our outcome, including information about escalation to the BBC Data Protection Officer

Stage 2: Data Protection Officer Review

If you are not satisfied with the Stage 1 response, you can ask for the complaint to be escalated to Stage 2 for review by the BBC’s Data Protection Officer.

How to escalate:

• Contact the BBC Data Protection Office to request escalation within 30 calendar days of receiving the Stage 1 response

What happens:

The DPO will:

• conduct an independent review of the complaint
• request further information from the data subject or internally, where necessary
• issue a final outcome within three (3) months (unless your case is complex), including information about escalation to the ICO. Complex complaints may take longer to investigate 

Escalation to the Information Commissioner’s Office (ICO)

If you remain dissatisfied after Stage 2, you have the right to complain to the ICO.

While you can complain to the ICO at any point, the ICO may expect individuals to have attempted to resolve concerns directly with the organisation before seeking regulatory intervention. The ICO has published its Data Protection Framework which sets out how they handle data protection complaints, including how they determine if they will investigate a complaint.

ICO contact details:

• Website: ico.org.uk/make-a-complaint
• Phone: 0303 123 1113
• Address: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

6. Subject Access Request (SAR) Internal Reviews

If you are unhappy with how the BBC has responded to your Subject Access Request (SAR), you may request an internal review by the BBC’s Data Protection Officer (DPO). The purpose of the review is to independently assess whether your SAR was handled fairly, lawfully and in accordance with applicable data protection law, ICO guidance and BBC procedures. 

Requesting a SAR Internal Review

Requests for a SAR Internal Review should normally be made within 40 working days of receiving the SAR response. Requests submitted after this timeframe may not be accepted.

Information about how to request a review will be included in the SAR response.

SAR Internal Review Process 

The BBC has an internal review process, followed by the right to complain to the UK data protection regulator, the Information Commissioner’s Office (ICO):

1. Data Protection Officer review
2. ICO escalation

What the Internal Review Covers

The internal review will consider matters such as:

• how the SAR was interpreted and scoped;
• whether reasonable and proportionate searches were carried out;
• whether any exemptions or restrictions were appropriately applied;
• whether the response was provided within applicable timeframes; and
• whether communications were handled clearly and appropriately.

The review is not intended to repeat the original SAR process or automatically rerun searches. However, where appropriate, the BBC may take additional steps or provide supplementary information if issues are identified during the review.

Outcome of a SAR Internal Review

The BBC will provide a written outcome explaining:

• the findings of the review;
• whether the original SAR response is upheld or amended; and
• any further action the BBC considers appropriate.

The BBC aims to complete SAR Internal Reviews as promptly as practicable and ordinarily within three months, although complex cases may take longer.

Escalation to the Information Commissioner’s Office (ICO)

If you remain dissatisfied following the SAR Internal Review, you have the right to complain to the ICO.

ICO contact details:

• Website: ico.org.uk/make-a-complaint
• Phone: 0303 123 1113
• Address: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

7. Accessibility and Support

The BBC will provide reasonable support to help you make a complaint, including alternative formats or assistance where needed.

8. Monitoring and Improvement

• All complaints are logged and tracked
• Trends and outcomes are reviewed by the Data Protection Officer
• Lessons learned are used to improve data protection practices

9. Contact Details

Data Protection Officer, BBC Public Service

• Email: dataprotection.officer@bbc.co.uk
• Post: Floor 6C, Broadcasting House, London, W1A 1AA

10. Policy Review

The BBC will review this Data Protection Complaints Policy every two years, or sooner where necessary to reflect changes in legislation, regulation, or guidance issued by the ICO.