What to Do When the ICO Rejects Your Complaint

The first question: what exactly are you challenging?

When the ICO does not uphold a complaint, the natural reaction is to say that the decision is wrong. That may be true. But for tactical purposes, “wrong” is too broad. The next step depends on the type of error you say has occurred.

There are usually six possible problems. The ICO may have misunderstood the evidence. It may have applied its complaint-handling framework too lightly. It may have failed to respond or delayed unreasonably. It may have treated a data-protection issue as ordinary customer service. It may have made a legal error. Or the ICO may have reached a limited outcome because it cannot award compensation or act as a private representative for the complainant.

This distinction matters because different bodies can do different things. The ICO can review how it handled a complaint. The First-tier Tribunal can deal with specified information-rights appeals and certain data-protection applications. The Parliamentary and Health Service Ombudsman can consider poor service or maladministration by public bodies where its jurisdiction is engaged. The High Court can consider judicial review where a public-law challenge is properly available. A county court or High Court claim may be relevant where compensation is sought from the organisation that misused personal data.

Ask the ICO to review the complaint outcome

If the issue is that the ICO overlooked evidence, misunderstood harm, failed to make further enquiries, or applied its complaint framework too narrowly, the immediate route is usually to ask the ICO for a review. Do this promptly and within any deadline stated in the ICO’s outcome letter.

The review request should not simply repeat the original complaint. It should explain what the ICO got wrong and why that mattered. A strong request usually contains a short chronology, the key documents, the specific data-protection issue, the harm or risk of harm, and the precise part of the ICO’s reasoning that is challenged.

The review route is usually best where your complaint is still about the ICO’s handling of your data-protection complaint rather than a wider public-law challenge. It is also generally lower risk than immediately threatening judicial review or publicising the matter before the evidential record is clean.

The tribunal route: useful, but not universal

The First-tier Tribunal in the General Regulatory Chamber handles information-rights matters, including appeals against certain decisions of the Information Commissioner. But the tribunal route is often misunderstood. A disappointed complainant should not assume that every ICO data-protection complaint outcome can simply be appealed on the merits.

The tribunal route may be relevant where there is an appeal against a decision notice concerning freedom of information or other information requests, certain decisions under the Data Protection Act 2018, or where a direction is sought because the ICO has not responded within the relevant statutory framework. The exact route depends on the legislation, the document received, and what the ICO has or has not done.

Where a tribunal route is available, time limits are short. The appeal or application should be drafted around the legal basis for the tribunal’s jurisdiction, not merely dissatisfaction with the ICO. Include the decision notice, complaint date, outcome letter, key correspondence and a concise explanation of why the ICO’s decision was legally wrong or why a direction is sought.

The PHSO route: poor service, maladministration and process failure

If the issue is not the ICO’s legal conclusion but the way the ICO handled you, the Parliamentary and Health Service Ombudsman may be relevant. This route is aimed at complaints about poor service or maladministration by public bodies where the Ombudsman has jurisdiction.

Examples may include serious delay, poor communication, failure to follow process, failure to consider relevant information, or unfair handling. The PHSO route should not be treated as a simple appeal on the merits. It is concerned with whether the public body acted properly and fairly, and whether any failure caused injustice.

For complaints about UK government departments or other public organisations, the PHSO route may require involvement of an MP and is subject to time limits. It is important to complete the ICO’s own complaint or review process first unless there is a clear reason why that is not possible.

Judicial review: last resort, not first reaction

Judicial review may be relevant where the ICO’s decision or conduct is said to be unlawful, procedurally unfair, irrational, or outside its powers. It is not a way of asking the court to decide the complaint afresh simply because you disagree with the outcome.

This route is high risk. It can involve strict urgency, costs exposure, pre-action correspondence, permission requirements and careful analysis of alternative remedies. A claimant who has not used an available review, tribunal or ombudsman route may face difficulty unless there is a strong reason why judicial review is still appropriate.

Judicial review should therefore be treated as a specialist public-law remedy. It may be powerful in the right case, but it is rarely the correct first step after an ordinary disappointing ICO complaint outcome.

Compensation, advocacy and public pressure

The ICO cannot award compensation. If you have suffered material loss or distress because an organisation breached data-protection law, the compensation route is usually a claim against the organisation, not an application asking the ICO to award damages.

Public advocacy can also be legitimate where a case reveals systemic data-protection failure, repeated organisational misconduct, regulatory weakness or a matter of public importance. But publicity should be handled carefully. Data-protection complaints often involve personal data, third-party material, confidential correspondence, employment records, health information, safeguarding issues, litigation risk or allegations against named organisations.

Public pressure is most effective when the evidential record is disciplined. A focused article, MP letter or public complaint should explain what happened, what the ICO did, why the process is said to be inadequate, and what reform or remedy is being sought.

Decision route map

Use this route map before sending the next letter or issuing the next application.

Closing point

A disappointing ICO outcome should not be met with a scattergun response. The stronger approach is to diagnose the failure, preserve the evidence, choose the correct route, and draft around the test that route applies.

If the issue is evidence, ask for review. If the issue is service failure, consider complaint escalation and the PHSO route. If the issue is a statutory decision or delay, check the tribunal route. If the issue is compensation, consider the organisation responsible for the data breach. If the issue is unlawfulness by the ICO, take urgent advice before judicial review.

The goal is not simply to keep arguing. The goal is to move the case into the forum that can actually do something about the problem.