1.    Introduction

The CPS is required to have a data protection complaints procedure as set out in the Data (Use and Access) Act 2025 (DUAA), which amended the UK GDPR and the Data Protection Act 2018 (DPA). This requirement came into force on 19 June 2026.

2.     Data protection law says organisations must:

•    give people a way of making data protection complaints
•    acknowledge receipt of complaints within 30 days of receiving them 
•    without undue delay, take appropriate steps to respond to complaints,
including making appropriate enquiries, and keep people informed and, notify them of the outcome of their complaints.

3.    Data Protection Complaints (DPC)

This DPC procedure should be used when:
•    a data subject considers that the CPS has infringed data protection legislation due to the way we have handled their personal information
•    or the personal information of someone they are acting on behalf of

4.    This procedure covers complaints about:

•    how the CPS responded to a request made under the Data Protection Act 2018
•    the security measures used by the CPS to store someone’s information, including concerns raised by a person affected by a data breach, whether or not it is reportable to the regulator; or
•    how the CPS has collected or used someone’s personal information (e.g. where the information has been stored or how long the CPS has kept it for, or its accuracy)
•    any other matter relating to data protection.

5.    How long do I have to make a complaint

The CPS will only consider complaints received within six months of the matter complained about. Complaints received outside this period will only be considered in exceptional circumstances, for example where you became aware of the matter more than six months after it occurred.

6.    How to make a data protection complaint

You can make a data protection complaint through our online form, by submitting a complaint form to [email protected] or in writing to the following address:

Jackie Ronchetti OBE
CPS Data Protection Officer
Security and Information Assurance Division
Crown Prosecution Service
102 Petty France
Westminster
London SW1H 9EA

7.    Supporting information required to investigate a complaint

The CPS may need to ask someone who has made a complaint for proof of identity before we can proceed. If proof of identity is required, we will ask for it at the earliest opportunity. 
Complaints may be made on behalf of another person (for example, by a family member, solicitor, child advocacy service, or other relevant not-for-profit organisation). In these cases, the CPS will check that the person making the complaint is authorised to act on the other person’s behalf. This may require evidence such as: 
•    an appropriate power of attorney; or
•    a signed letter of authority from the person they are acting on behalf of
In the absence of appropriate evidence, the CPS will not investigate the complaint.

8.    Data protection complaints made using social media

Although it is possible to make a complaint through social media, the CPS will not respond through social media because it is not a secure way to provide information. Please see “How to make a Data Protection complaint” for alternative methods.

9.    Data protection complaints from children

Children have the same rights over personal information as adults. However, children merit specific protection as they may be less aware of the risks and consequences of the processing and their rights when their personal information is being processed.  When responding to a complaint from a child the CPS will use plain, clear language they can understand.

10.    How the CPS will handle data protection complaints

What to expect from us

•    The CPS will aim to acknowledge receipt of a complaint received within three working days.

•    The CPS will aim to investigate the complaint and provide an outcome within one calendar month.  However, complex complaints may take longer to resolve.  If additional time is needed, we will tell you.

•    When necessary, the CPS will request additional information or clarification to ensure our substantive response is complete.

•    We will keep the person who has made the complaint updated on the progress of the investigation.

11.    After we have responded to your complaint

The CPS will retain details of your complaint and outcome in accordance with the appropriate retention schedule.
If you remain unhappy after being notified of the outcome, you have the right to complain to the Information Commissioner’s Office.

12.    Review of this Data Protection Complaints Procedure (DPCP)

This complaints procedure will be reviewed every two years or sooner if there are other changes required, e.g. to legislation.

13.    CPS Feedback and Complaints Policy (FCP)

The CPS also has an overarching Feedback and Complaints Policy (FCP) and related guidance. The FCP is intended for complaints relating to:
•    legal decisions made by the CPS,
•    the way in which we have conducted ourselves or,
•    complaints containing both legal and service complaints.

The FCP and guidance are separate from this Data Protection Complaints (DPC) procedure.