We need to comply with the Data Protection Act 2018 and UK General Data Protection Regulations (UK GDPR). This policy has been developed to ensure all staff, contractors and partners understand their obligations when processing personal and special category data.
This policy and the legislation apply to all personal data, both that held in paper files and electronically. So long as the processing of the data is carried out for council purposes, it applies regardless of where data is held.
‘Processing’ data is widely defined and includes obtaining, recording, keeping, or using it in any way; sharing or disclosing it; erasing and destroying it.
How to complain about how we use your personal data
Section 103 of the Data (Use and Access) Act 2025 (DUAA 2025) introduced a statutory right for data subjects to complain to data controllers about potential infringements of the UK GDPR or Part 3 of the Data Protection Act 2018.
If you are concerned about how your personal data has been processed by us or you consider that your data has been breached by us (including if it was lost, shared or misused), you can submit a complaint to the council’s Data Protection team (contact below).
Please include full details of your concern and provide details to help us identify you and your data including account and/or reference numbers.
We will not usually investigate concerns where there has been an undue delay in bringing the matter to our attention. You should raise your concerns with us within three months of your last meaningful contact with the us.
Your complaint will usually be considered by an officer in the Information Governance Team. The Information Governance Officer will:
- log your complaint and acknowledge receipt within 30 days
- undertake any necessary investigations and respond directly to you without undue delay, usually within one calendar month of acknowledgement; where it is not possible to meet the calendar month deadline, you will be contacted and provided with an alternative timescale
In the case of a serious complaint, the Information Governance Officer may refer the complaint to the council’s Data Protection Officer to consider, following the same process.
If you are not satisfied with the response to your complaint, you may raise the matter with the Information Commissioner’s Office (ICO). The ICO is the UK regulatory body for data protection matters. Read about how the ICO handles data protection complaints.
Complaints related to service delivery
If your data complaint contains issues related to service delivery, it will be dealt with under the two stages of the corporate complaints procedure or the statutory social care complaints procedure, depending on the service complained about. For more information on Luton Council complaints, please see the Comments, compliments and complaints webpage.
How to make a complaint
Tell us:
- what your concern is
- enough details to help us find your information, such as account or reference numbers
Email: dataprotection@luton.gov.uk
When to contact us
You should contact us within three months of your last important contact with the Council. We may not look into complaints made after this time.
What happens next
Your complaint will be looked at by the Information Governance team. They will:
- record your complaint and confirm they have received it within 30 days
- investigate and reply to you as soon as possible, usually within one month
If we need more time, we will let you know and explain why.
For serious complaints, a senior officer called the data protection officer may also review the case.
If you are not happy with our response
If you are not satisfied, you can contact the Information Commissioner’s Office (ICO). The ICO is the UK organisation that makes sure data protection laws are followed.