Corries Solicitors Ltd: Data Protection (UK GDPR) Complaints Procedure

At Corries Solicitors Ltd, we take the confidentiality, privacy, and security of your personal data extremely seriously. As a law firm regulated by the Solicitors Regulation Authority (SRA), we maintain strict ethical and legal standards regarding data handling.
If you believe that your personal data has been handled incorrectly, or that we have not complied with your statutory rights under the UK General Data Protection Regulation (UK GDPR) or the Data Protection Act 2018, this document outlines how you can lodge a formal complaint and how we will investigate and resolve it.

This procedure is limited to issues about GDPR and is compliant with Section 164A of the GDPR Data (Use & Access) Act 2025.
This complaint procedure is separate to the complaint procedure about your compensation claim which is on our website here>>>>>

1. How to Make a Data Protection Complaint
To ensure your complaint is directed to the responsible individual and handled promptly, please submit your data protection concern directly to our Data Protection Officer (DPO):
• Data Protection Officer: Howard Bonnett (Director)
• Email: howard.bonnett@corries.co.uk marked for the attention of Howard Bonnett, DPO)
• Direct Telephone: 01904 527464
• General Telephone: 01904 527430
• Postal Address:
Howard Bonnett (Data Protection Officer)
Corries Solicitors Ltd
Melroses Yard,
Walmgate
York, YO1 9XF

2. Information to Include in Your Complaint
To assist us in processing your complaint efficiently, please include the following details when contacting us:
• Your Full Name and Contact Details (telephone number, email address, and postal address).
• Reference Number (if you are a client or have an existing matter with Corries Solicitors Ltd).
• Details of the Complaint:
o What specific issue occurred (e.g., unauthorized disclosure, delay responding to a Subject Access Request, inaccurate data retained, etc.).
o Relevant dates and times.
o Any relevant communications or evidence supporting your concern.
• Desired Resolution: What outcome or remedial action you are seeking.

3. Our Investigation Procedure & Timeline
We follow a structured procedure to ensure all data protection complaints are investigated thoroughly, fairly, and transparently.
┌──────────────────────────┐ ┌──────────────────────────┐ ┌──────────────────────────┐
│ 1. Receipt & Ack │ ──► │ 2. Investigation │ ──► │ 3. Written Response │
│ (Within 5 working days) │ │ (Review & Internal Audit)│ │ (Within 1 calendar mth) │
└──────────────────────────┘ └──────────────────────────┘ └──────────────────────────┘
Stage Action Taken Expected Timescale
Stage 1: Acknowledgment We will formally record your complaint in our internal Data Protection Complaints Register and send you a written acknowledgment confirming the name of the handler. Within 5 working days of receipt
Stage 2: Investigation The DPO will review your file, consult with relevant legal and IT personnel, and investigate whether a statutory breach or procedural error occurred. Ongoing throughout the month
Stage 3: Decision & Findings We will issue a formal written response detailing our findings, whether the complaint is upheld, and any remedial steps or corrective actions taken. Within 1 calendar month of receipt

Note on Complex Matters:
Under UK GDPR guidelines, if your complaint involves complex technical or legal issues requiring extended investigation, we may extend the response period by up to an additional two months. If an extension is required, we will inform you within the initial month, explaining the reasons for the delay.
4. Remedial Actions We May Take
If your complaint is upheld, Corries Solicitors Ltd will take immediate corrective action. Depending on the circumstances, this may include:
• Rectifying or updating inaccurate personal data.
• Restricting processing or securely erasing data where required under statutory obligations.
• Implementing additional technical or organizational security protocols.
• Providing targeted data protection retraining to relevant personnel.

5. Escalation and External Regulatory Bodies
We aim to resolve all data protection complaints internally. However, if you remain unsatisfied with our response, or if you believe we are processing your personal data unlawfully, you have the right to escalate your complaint to the relevant regulatory authority.
The Information Commissioner's Office (ICO)
The ICO is the UK's independent supervisor for data protection rights.
• Website: www.ico.org.uk
• Helpline: 0303 123 1113
• Postal Address: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Solicitors Regulation Authority (SRA) or Legal Ombudsman
If your complaint relates broader client service issues or professional conduct alongside data protection, you may also refer to:
• Legal Ombudsman: www.legalombudsman.org.uk | 0300 555 0333
• SRA: www.sra.org.uk (for potential breaches of professional standards)