Data (Use and Access) Act 2025 – Complaint Process
Introduction
Gayton Junior School and Ridgeway Infant School are committed to protecting the privacy and personal data of its students, staff, parents/carers, governors and the wider school community. This webpage outlines our procedure for handling complaints related to data usage and access, in accordance with the Data Usage Access Act (DUAA) and other relevant UK data protection legislation, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA 2018).
The UK GDPR documents as set out on our website provide an overview of how personal data is managed across our setting.
This is an appendix to the main complaint policy and reflects the requirement for standalone data usage complaints to be handled using a separate procedure. Any complaint that is linked to other matters whether raised as a formal or informal complaint are to be dealt with under the standard complaint process as outlined within the main complaint policy.
Roles and responsibilities
The Data Controller (DC) is responsible for ensuring compliance with this policy and the legal obligations imposed by the UK GDPR, Data Protection Act 2018, Data Usage and Access Act 2025 and other relevant legislation. The DC will delegate day to day management of this to the relevant staff member and the DC will expect that staff member to investigate any complaint unless there is a conflict of interest, in which case the DC will appoint a suitable person.
The headteacher and leadership team are responsible for ensuring all staff are aware of this policy and their data protection obligations.
All staff members are responsible for handling personal data in a secure and lawful manner and for co-operating fully with any investigation into a data usage or access complaint.
Scope
This policy applies to all individuals who have dealings with the school and believe that their personal data has been used or accessed inappropriately, or that their rights under the DUAA and other data protection laws have been infringed.
This includes but is not limited to:
- current and former students
- parents/carers
- school staff (teaching, support, and administrative)
- governors
- volunteers
- contractors and suppliers
Principles
Fairness and transparency: All complaints will be handled in a fair, impartial, and transparent manner.
Confidentiality: Complaints and all related information will be treated with the utmost confidentiality, unless disclosure is required by law.
Timeliness: Complaints will be acknowledged and investigated in a prompt manner.
Compliance: All actions taken will comply with the DUAA, UK GDPR, DPA 2018, and other relevant legislation.
The complaint procedure
Step 1: Informal resolution
We encourage individuals to first attempt an informal resolution of their concerns. If you have a concern about data usage or access, you should, in the first instance, raise it with the relevant member of staff or senior person – Mrs M Hollis, School Business Manager, mhollis@ridgeway.derby.sch.uk OR Mrs J Hardisty, School Business Manager, admin@gaytonj.derby.sch.uk
In many cases, issues can be resolved quickly and informally at this stage.
Step 2: Formal complaint submission
If the informal approach is not successful or deemed inappropriate, a formal complaint should be submitted in writing using the complaint form. Please contact school for a printed version.
The complaint should be addressed to – Mr A Beattie, Headteacher, head@ridgeway.derby.sch.uk OR Mrs J Hill, Headteacher, head@gaytonj.derby.sch.uk
The written complaint should be made on the complaint form or shall include the following information:
- your full name and contact details.
- a clear and concise description of the complaint, including what happened, when it happened, and who was involved.
- a description of the data involved and how you believe it was used or accessed inappropriately.
- any relevant dates, times, or evidence.
- details of any informal steps you have already taken to resolve the issue.
- the desired outcome of the complaint.
Step 3: Acknowledgment and investigation
You will receive an acknowledgment of the written complaint within 5 working days of the setting receiving it.
The DC will conduct a thorough and impartial investigation into the complaint.
This may involve:
- interviewing the complainant
- interviewing relevant staff members
- reviewing school records, logs, and policies
- consulting with external legal or data protection experts if necessary
The school will aim to complete the investigation and provide a substantive response within 20 working days of the complaint’s acknowledgment. If the investigation is complex and requires more time, the DC will write to the complainant to explain the reason for the delay and provide a new estimated completion date.
Response
The DC will provide a formal written response to the complainant.
This response will include:
- the findings of the investigation.
- a clear and reasoned conclusion as to whether the DUAA or other data protection laws have been breached.
- details of any corrective action taken or planned to prevent a recurrence of the issue.
- the outcome of the complaint, including whether it has been upheld, partially upheld, or not upheld.
- information on the next steps available to the complainant if they remain dissatisfied.
Escalation
If the complainant is not satisfied with the school’s final response, they have the right to escalate their complaint to the Information Commissioner’s Office (ICO).
The ICO’s contact details are as follows:
Website: https://ico.org.uk
Telephone: 0303 123 1113
Postal Address: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Procedure Review
This procedure will be reviewed annually by the Data Protection Officer and the school leadership team to ensure it remains relevant, effective, and compliant with all current legislation.
Date of implementation: September 2025
Review date: August 2026
