Data Protection Complaints Procedure

This procedure explains how you can raise a Data Protection Complaint if you are unhappy with how we have handled your personal information. It is separate from our service complaints process, which deals with concerns about the legal services we provide.

A data protection complaint may relate to issues such as how we have used your personal information, how long we have kept it, the accuracy of the information we hold, our response to a data rights request, or concerns arising from a data breach.

1. How to Make a Data Protection Complaint

You may make a complaint through any channel. You do not need to use a specific form.

You can contact us in any of the following ways:

• Email: info@mauriceandrewssolicitors.co.uk
• Post: 182 Soho Hill, Birmingham, England, B19 1AG
• Telephone: 0121 554 4900
• In person: speak to your usual contact at the firm, who will pass your complaint to the appropriate person.

If you would like a copy of our Data Protection Complaints Form, we will provide one on request. If you need help making a complaint or require this procedure in an alternative format, please tell us.

2. What to Include in Your Complaint

Providing the following information will help us investigate your concerns efficiently:

• Your name and contact details
• How you are connected to the matter (e.g., client, former client, third party)
• What personal information you believe is affected
• What happened and when
• Why you are unhappy with how we handled your personal information
• What outcome you are seeking
• Any relevant reference numbers or correspondence

3. What Happens After You Complain

Your complaint will be passed to our Data Protection Supervisor (DPS) who is responsible for handling data protection complaints.

Acknowledgement

We will acknowledge your complaint within 30 days of receiving it.

Investigation

We will investigate your complaint without undue delay and may contact you if we need more information.

Identity Checks

To protect confidentiality, we may need to verify your identity before sharing information with you. We will not ask for more information than necessary and will not insist on ID where it would be unreasonable.

Requests for Clarification

If your complaint is unclear or very broad, we may ask you to clarify your concerns.

Where clarification is requested, the response deadline may be paused until we receive the information needed.

4. Complaints Involving Children

If a complaint is made by a child or on their behalf, we will:

• Communicate in clear, plain language appropriate to the child’s age
• Assess the child’s capacity to understand and exercise their rights
• Accept complaints from parents, guardians, advocates, charities, or solicitors acting for the child

5. Our Response

Once our investigation is complete, we will write to you with:

• The outcome of our investigation
• Any steps we have taken or propose to take
• Information about your right to escalate the matter to the ICO

We cannot refuse to accept a data protection complaint.

6. Escalating Your Complaint to the ICO

If you are unhappy with our response, or if we fail to respond within a reasonable time, you may escalate your complaint to the Information Commissioner’s Office (ICO).

Further information is available at:

https://ico.org.uk/make-a-complaint

We will inform you of your escalation rights in our written response.

7. How We Record and Use Complaint Information

We keep central records of all data protection complaints.

If required by the Secretary of State, we may need to report anonymised complaint data to the ICO.

8. Difference Between Data Protection Complaints and Service Complaints

A data protection complaint concerns how we handle your personal information.

A service complaint concerns dissatisfaction with the legal services we provide.

Service complaints are handled under our Complaints Procedure and by our Client Care Partner.