Data Protection Complaints Procedure

Last updated: August 2026

1. Purpose

The Compliance Classroom Ltd (“The Compliance Classroom”, “we”, “us” or “our”) takes the protection of personal information seriously.

We aim to handle personal information fairly, securely and in accordance with applicable UK data protection law.

If you have concerns about how we have collected, used, stored, shared or otherwise handled your personal information, you can raise a data protection complaint with us.

This procedure explains how to make a complaint and how we will respond.

2. Who Can Make a Complaint?

Anyone who has concerns about the way The Compliance Classroom handles their personal information can make a complaint.

This may include:

  • customers and their representatives;
  • school, academy, trust or other education setting staff;
  • learners and other users of The Compliance Classroom platform;
  • school or organisational administrators;
  • individuals whose personal information has been provided to us by a customer; and
  • other individuals whose personal information we process.

If you are making a complaint on behalf of another person, we may need to confirm that you are authorised to act for them before discussing their personal information with you.

3. How to Make a Complaint

You can make a data protection complaint by contacting:

The Compliance Classroom Ltd
Email: [email protected]

We encourage complaints to be made by email where possible so that we can deal with them efficiently.

If you are unable to contact us by email or require an alternative method of communication, please contact us and we will make reasonable arrangements to assist you.

There is no charge for making a data protection complaint.

4. What to Include in Your Complaint

To help us understand and investigate your concern, please provide as much relevant information as possible, including:

  • your name and contact details;
  • details of your concern;
  • what you believe has gone wrong;
  • the personal information involved, if known;
  • when the issue occurred, if known;
  • any relevant correspondence or supporting information; and
  • what you would like us to do to resolve the matter, where applicable.

You do not need to identify a particular provision of data protection law in order to make a complaint.

Please avoid sending unnecessary personal or sensitive information when making your complaint.

5. How We Will Handle Your Complaint

When we receive a data protection complaint, we will:

  1. record the complaint;
  2. acknowledge it as soon as reasonably practicable;
  3. review the information provided;
  4. identify the personal information and processing activities involved;
  5. investigate the complaint appropriately and without undue delay;
  6. contact you if we require additional information;
  7. keep you reasonably informed where an investigation requires additional time; and
  8. provide you with the outcome of our investigation as soon as reasonably practicable.

We will handle complaints fairly and objectively.

The time required to investigate a complaint will depend on its nature and complexity.

6. Complaints Involving a School or Organisation

In some circumstances, The Compliance Classroom processes personal information on behalf of a school, academy, trust or other organisation.

Where this applies, the organisation may act as the data controller and The Compliance Classroom may act as its data processor.

If your complaint concerns personal information that we process on behalf of one of our customers, we may need to refer the matter to, or work with, the relevant organisation.

Where appropriate, we may:

  • notify the relevant organisation;
  • provide reasonable assistance with its investigation;
  • act in accordance with the applicable Data Processing Agreement; and
  • cooperate with the organisation in responding to the complaint.

We will only share personal information where there is an appropriate lawful basis or where sharing is otherwise permitted or required by law.

7. Complaints Involving Service Providers

The Compliance Classroom uses selected third-party service providers to help deliver and support its services.

Where a complaint concerns processing involving one of these providers, we may work with the relevant provider to establish what happened and determine what action is required.

Information about the key third-party providers used by The Compliance Classroom is available in our Sub-processor List.

Where The Compliance Classroom remains responsible for the relevant processing, we will continue to handle the complaint in accordance with this procedure and applicable data protection law.

8. Identity Verification

In some circumstances, we may need to verify your identity before disclosing personal information or taking certain action.

This is intended to protect personal information from unauthorised access or disclosure.

We will only request information that is reasonably necessary for verification.

9. Investigation

The person responsible for handling the complaint will consider the relevant information and circumstances.

Depending on the nature of the complaint, this may include reviewing:

  • account information;
  • access and training records;
  • relevant communications;
  • policies and procedures;
  • data processing arrangements;
  • third-party service arrangements;
  • security information; and
  • relevant technical information.

Where appropriate, we may seek advice or assistance from professional, legal, data protection or technical advisers.

10. Outcome

Once our investigation is complete, we will provide you with an appropriate response.

Depending on the circumstances, our response may explain:

  • what we found;
  • whether we identified an error or data protection issue;
  • what action we have taken or intend to take;
  • any steps taken to reduce the risk of the issue recurring; and
  • any further information relevant to your complaint.

There may be circumstances in which we cannot provide particular information, for example where doing so could disclose another person’s personal information, compromise security or otherwise be unlawful.

11. Corrective Action

Where an investigation identifies a problem, we will consider appropriate corrective action.

Depending on the circumstances, this may include:

  • correcting inaccurate personal information;
  • deleting information where appropriate;
  • restricting processing where appropriate;
  • reviewing or improving procedures;
  • reviewing access controls;
  • addressing security or technical issues;
  • contacting a relevant customer or service provider;
  • updating relevant documentation or training; or
  • taking other appropriate remedial action.

Where an issue constitutes a personal data breach, we will handle it in accordance with our data breach procedures and consider any applicable notification or reporting requirements.

12. Complaints to the Information Commissioner’s Office

If you are unhappy with how we have handled your data protection concern, you have the right to raise a complaint with the Information Commissioner’s Office (ICO), the UK’s independent regulator for data protection and information rights.

You can find information about raising a concern on the ICO website.

We would welcome the opportunity to consider and resolve your concerns directly, but contacting us first does not affect your right to contact the ICO.

13. Records and Retention

We will maintain appropriate records of data protection complaints and how they were handled.

Complaint records will be retained only for as long as reasonably necessary in accordance with our legal, regulatory and legitimate business requirements and our Data Retention Policy.

Complaint records will be stored securely and access restricted to individuals who require access for legitimate purposes.

14. Confidentiality

We will treat data protection complaints confidentially as far as reasonably possible.

Information may need to be shared with relevant customers, service providers, professional advisers, regulators or other parties where this is reasonably necessary to investigate or resolve a complaint or where disclosure is required or permitted by law.

We will seek to limit any information shared to what is reasonably necessary for the relevant purpose.

15. Related Documents

This procedure should be read alongside our:

  • Privacy Notice
  • Learner Privacy Notice
  • School Administrator Privacy Notice
  • Data Processing Agreement
  • Data Retention Policy
  • Sub-processor List

16. Contact Us

If you have a question about this procedure or wish to make a data protection complaint, please contact:

The Compliance Classroom Ltd
Email: [email protected]