The University of Bath strives to collect and process personal data with the utmost integrity, transparency and legislation compliance. However, should circumstances arise in which you would like to raise a concern or complaint, please refer to the below complaints procedure, aligned with section 164A of the Data Protection Act 2018.

Submitting a complaint form

Complete the University of Bath Data Protection Complaint form, or use another form of communication to indicate concern or complaint such as emailing dataprotection@bath.ac.uk.

The Data Protection Office will formally acknowledge the complaint within 5 business days and will respond without undue delay. An investigation into the complaint will be then conducted, in accordance with the Data Protection Officer’s statutory independence under Article 38(3) of the UK GDPR.

Conflicts of interest

The University will take every measure to ensure there is no conflict of interest with handling your complaint:

• where the complaint is directed towards the University or a member of staff not supporting the Data Protection Office, then a member of the Data Protection Office (or a supporting colleague from the Legal team) will conduct the investigation
• where the complaint is directed to a member of the Data Protection Office (or a supporting colleague from the Legal team) or the Head of Information Governance, the investigation will be led by the Data Protection Officer
• where the complaint is directed at the Data Protection Officer, the investigation will be led by the Head of Information Governance and supported by appropriately qualified colleagues
• where a complaint raises concerns of sufficiently high risk (for example, where there are repeated/systemic failures in data protection compliance, where a large number of data subjects is affected, where escalation to the ICO is likely, or any other circumstances presenting equivalent risk), the Data Protection Officer and the Head of Information Governance will escalate the matter to the University Secretary to investigate and address the issue collaboratively
• where there is any other actual or perceived conflict of interest with the above members of staff, nominees can be appointed where appropriate

Next steps

The length of the investigation can vary depending on the details of the complaint, but either an outcome or update will be provided within 30 calendar days. Where appropriate, notes will be provided. The complaint will be registered in the University Incident log alongside any investigatory materials, communications and outcome.

Should you feel as though your complaint has not been appropriately addressed, or have concerns about the outcome, you can communicate with the Data Protection Office to discuss or alternatively contact the Information Commissioner to submit a complaint.