Purpose

At McNeil & Co Solicitors, we are committed to protecting the privacy and personal information of
our clients, employees and everyone whose personal data we process. We handle personal
information in accordance with the UK General Data Protection Regulation (UK GDPR), the Data
Protection Act 2018, as amended, and the Data (Use and Access) Act 2025. In particular, section
103 of the Data (Use and Access) Act 2025 inserted section 164A into the Data Protection Act
2018, establishing requirements for organisations to receive, acknowledge, investigate and
respond to data protection complaints.

The purpose of this procedure is to explain who can complain, how to contact us, how we will
consider complaints about our handling of personal information and how to raise concerns with
the Information Commissioner’s Office (ICO). We aim to handle complaints fairly, consistently and
without undue delay.

Who can make a complaint

Anyone who believes that we have not complied with data protection law when handling their
personal information may make a complaint. This includes current and former clients, prospective
clients, employees and former employees, job applicants, suppliers, contractors and other
individuals whose personal information we process.

A complaint may also be made by someone acting on your behalf, such as a solicitor, family
member or other authorised representative. We may ask for evidence of their authority before
sharing personal information. You do not need to refer to any particular law or use formal wording
to make a complaint.

What you can complain about

You can complain if you believe that we have not handled your personal information in
accordance with data protection law. This may include concerns about:
• How we collect, use, store or share your personal information.
• Whether your personal information has been kept secure or disclosed without authorisation.
• Information we hold about you being inaccurate or incomplete.
• How long we keep your personal information.
• How we have responded to a subject access request or a request to correct, erase or restrict
the use of your information.
• A failure to explain how or why we use your personal information.
• Any other concern about our compliance with data protection legislation.
Complaints about the quality of our legal services may be dealt with under our separate client
complaints procedure.

Who to complain to and contact details

Please direct any data protection complaint to Mark McNeil, who is the firm’s designated contact
for data protection complaints:
Mark McNeil
McNeil & Co Solicitors
141–142 High Street
Lincoln
LN5 7PJ
Email: mark.mcneil@mcneilandco.co.uk

You may make a complaint by email, post, telephone or in person. Please provide your name and
contact details, a description of your concern, relevant dates or correspondence and the outcome
you are seeking. You may complain through an authorised representative; we may ask for
evidence of their authority before sharing personal information. You do not need to use any
particular legal terminology to complain.

How we handle complaints

We will acknowledge receipt of your data protection complaint without undue delay and no later
than 30 days after receiving it. We will make appropriate enquiries, which may include reviewing
relevant records and speaking with staff, and we may contact you for further information. We will
keep you informed of progress and explain the outcome of our investigation without undue delay.

We aim to provide a substantive response within 30 calendar days where reasonably practicable.
This is our service target, not a statutory deadline for resolving every complaint. If the matter is
complex or takes longer, we will update you and explain the next steps. Where appropriate, we
will take action to address issues identified.

If your correspondence also includes a request to exercise your data protection rights, we will
handle that request under the applicable statutory deadlines. Suspected personal data breaches
will be assessed separately under our breach-response procedures.

Investigation of complaints

We will investigate data protection complaints fairly, objectively and proportionately, without
undue delay. Mark McNeil will oversee the handling of complaints and may arrange for an
appropriate person who is not directly involved in the matter to conduct the investigation.

Our investigation may include reviewing relevant records and correspondence; examining the
personal data and processing activities concerned; speaking with relevant members of staff;
checking our policies and procedures; and assessing whether a personal data breach has
occurred. We may contact you to clarify your concerns or request further information.

We will keep you appropriately informed of progress. Once our investigation is complete, we will
explain our findings, whether your complaint has been upheld in whole or in part, and any action
taken or proposed. Where appropriate, we may correct information, improve procedures or
introduce additional safeguards. We will communicate the outcome without undue delay.

Confidentiality

We will handle complaints sensitively and share information only where necessary and lawful. We
will respect legal professional privilege and other applicable legal restrictions.

If you remain dissatisfied

If you are dissatisfied with our response, you can complain to the Information Commissioner’s
Office (ICO), the UK’s independent data protection regulator. You may contact the ICO at any
stage, although we encourage you to give us an opportunity to address your concerns first.

Information Commissioner’s Office (ICO)
Website: ico.org.uk
Telephone: 0303 123 1113