Data Protection Complaints Procedure

Introduction

2TG are required to have a data protection complaints procedure as set out in the Data (Use and Access) Act 2025 (DUAA), which amended the UK GDPR and the Data Protection Act 2018 (DPA). This requirement came into force on 19 June 2026.

Data protection law says organisations must:

• Give people a way of making data protection complaints
• Acknowledge receipt of complaints within 30 days of receiving them
• Without undue delay, take appropriate steps to respond to complaints, including making appropriate enquiries, and keep people informed and notify them of the outcome of their complaints.

Data Protection Complaints (DPC)

This DPC procedure should be used when:

• A data subject considers that 2TG has infringed data protection legislation due to the way we have handled their personal information
• Or the personal information of someone they are acting on behalf of

The procedure covers complaints about:

• how 2TG responded to a request made under the Data Protection Act 2018
• the security measures used by 2TG to store someone’s information including concerns raised by a person affected by a data breach, whether or not it is reportable to the regulator; or
• how 2TG has collected or used someone’s personal information (e.g. where the information has been stored or how long 2TG has kept it for, or its accuracy)
• any other matter relating to data protection.

How long do I have to make a complaint

2TG will only consider complaints received within six months of the matter complained about. Complaints received outside this period will only be considered in exceptional circumstances, for example where you became aware of the matter more than six months after it occurred.

How to make a data protection complaint

You can make a data protection complaint by submitting the complaint to kpoulton@2tg.co.uk or in writing to the following address:

Karen Poulton
2TG
2 Temple Gardens
London
EC4Y 9AY

Supporting information required to investigate a complaint

2TG may need to ask someone who has made a complaint for proof of identity before we can proceed. If proof of identity is required, we will ask for it at the earliest opportunity. Complaints may be made on behalf of another person (for example, by a family member, solicitor, child advocacy service, or other relevant not-for-profit organisation). In these cases, 2TG will check that the person making the complaint is authorised to act on the other person’s behalf. This may require evidence such as:

• an appropriate power of attorney; or
• a signed letter of authority from the person they are acting on behalf of

In the absence of appropriate evidence, 2TG will not investigate the complaint.

Data protection complaints made using social media

Although it is possible to make a complaint through social media, 2TG will not respond through social media because it is not a secure way to provide information. Please see “How to make a Data Protection complaint” for alternative methods.

Data protection complaints from children

Children have the same rights over personal information as adults. However, children merit specific protection as they may be less aware of the risks and consequences of the processing and their rights when their personal information is being processed. When responding to a complaint from a child, 2TG will use plain, clear language they can understand.

How 2TG will handle data protection complaints

What to expect from us:

• 2TG will aim to acknowledge receipt of a complaint received within three working days.
• 2TG will aim to investigate the complaint and provide an outcome within one calendar month. However, complex complaints may take longer to resolve. If additional time is needed, we will tell you.
• When necessary, 2TG will request additional information or clarification to ensure our substantive response is complete.
• We will keep the person who has made the complaint updated on the progress of the investigation.

After we have responded to your complaint

2TG will retain details of our complaint and outcome in accordance with the appropriate retention schedule.

If you remain unhappy after being notified of the outcome, you have the right to complain to the information Commissioner’s office.

Review of this Data Protection Complaints Procedure (DPCP)

This complaints procedure will be reviewed every two years or sooner if there are other changes required, e.g. to legislation.

2TG Complaints Policy (CP)

2TG also has a Complaints Policy. The Complaints Policy is intended for complaints relating to Chambers or any individual Barrister or staff member.

The Complaints Policy and guidance are separate from this Data Protection Complaints (DPC) procedure.