Document text
Date: [DD MONTH YYYY]
Sent by [E-MAIL TO THE DATA PROTECTION CONTACT / THE COMPANY'S COMPLAINT FORM / RECORDED DELIVERY] — please confirm receipt
To:
Data Protection Officer
[COMPANY NAME]
[ADDRESS OR E-MAIL FROM THE COMPANY'S PRIVACY NOTICE]
From:
[YOUR FULL NAME]
Customer account / e-mail used with the company: [ACCOUNT E-MAIL OR NUMBER]
[YOUR ADDRESS] · [PHONE]
Subject: Complaint under section 164A of the Data Protection Act 2018 and subject access request — [DESCRIPTION OF THE INCIDENT, E.G. "SECURITY INCIDENT ANNOUNCED ON (DATE)"]
Dear Data Protection Officer,
I am a customer of [COMPANY NAME]. On [DATE] I [RECEIVED YOUR E-MAIL / READ IN THE NEWS / WAS TOLD] that my personal data may have been accessed without authorisation.
1. My complaint
I consider that, in connection with my personal data, there has been an infringement of the UK GDPR. I make this complaint to you as controller under section 164A of the Data Protection Act 2018.
[KEEP THE POINTS THAT APPLY, DELETE THE OTHERS]
My data was not kept secure: [DESCRIBE WHAT YOU KNOW — E.G. NAME, ADDRESS, ORDER HISTORY, PARTIAL CARD DETAILS].
I was not told about the breach without undue delay, or the message did not explain what happened and what I should do.
Since the incident I have [RECEIVED PHISHING E-MAILS / TEXTS / CALLS ON (DATES) / SEEN UNKNOWN ORDERS / LOST MONEY: £(AMOUNT)].
2. What I ask you to do
1. Acknowledge this complaint within 30 days of receiving it, as section 164A(3) requires, and tell me how it will be handled.
2. Investigate and tell me the outcome without undue delay, with progress updates.
3. Tell me exactly what happened to my data: which of my personal data was affected, when the breach happened and when you found it, the likely consequences, and what you have done and recommend I do (Article 34 UK GDPR).
4. Subject access request. Under Article 15 UK GDPR, please send me a copy of the personal data you hold about me, the purposes, the recipients (including any third party involved in the incident) and how long you keep it, within one month of receiving this letter.
5. Compensation. I reserve my right to compensation for material and non-material damage under Article 82 UK GDPR. [OPTIONAL: I ASK FOR £(AMOUNT) FOR (LOSS / DISTRESS / TIME SPENT)].
Please reply in writing to [E-MAIL OR ADDRESS]. If I am not satisfied with your response, I may complain to the Information Commissioner's Office.
Yours faithfully,
______________________________
[YOUR FULL NAME]
Attachments:
1. The company's notice about the incident (if any).
2. Examples of suspicious messages or transactions, with dates.
3. [PROOF OF IDENTITY, ONLY IF THE COMPANY ASKS FOR IT].
BEFORE SENDING — delete this part
Use the company's own route. Since 19 June 2026 companies must make it easy to complain, for example with an electronic complaint form. Use it if there is one, and paste this text into it.
Write down the date they received it. The 30 days for acknowledgement and the one month for your data run from that day.
Protect yourself now: change the password used with that company and anywhere you reused it; watch for messages that quote your order details.
Field labels in [SQUARE BRACKETS, CAPITALS] must be completed or deleted. Alternatives are separated by a slash. © Layers (layers.md), licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Template, not legal advice.
Reply to this document or get a deadline reminder: https://layers.md/uk/data-breach-complaint-letter?from=reply-uk-rez-data-breach