Grace Wyndham Goldie (BBC) Trust Fund - Data Protection Complaints Policy

Purpose

The Grace Wyndham Goldie (BBC) Trust Fund (the GWG) is committed to protecting personal data and respecting individuals’ rights under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 (DPA 2018), the Data (Use and Access) Act 2025 (DUAA 2025) and the Privacy and Electronic Communications Regulations 2003 (PECR 2003).

This policy explains how individuals can raise a complaint about how the GWG has handled their personal data, and how those complaints will be managed in a fair, transparent, and timely manner. Individuals are encouraged to complete the GWG’s internal complaints process before escalating concerns to the Information Commissioner’s Office (ICO). 

Scope

This policy applies to anyone whose personal data is processed by the GWG where UK data protection law applies.

It covers complaints relating to:

• How your personal data is collected, used, shared or retained
• The accuracy of your personal data
• The security of your personal data
• Handling of your data subject rights request
• Subject Access Request Internal Reviews
• Delays or failures in responding to data subject rights requests
• Alleged breaches of data protection law
• Any other concerns about how personal data is handled

If your complaint relates to how your personal data is processed by BBC, please refer to the BBC Data Protection Complaints Policy.

What is out of scope:

• General service complaints not relating to personal data.
• Appeals against grant decisions made by the Trustees of the GWG.

The GWG may decline to take further action on complaints that are a duplication of an existing complaint or that are manifestly unfounded or excessive, taking into account the requirements of applicable data protection law.

Our Commitment

The GWG will:

• Treat all complaints seriously and respectfully
• Make it easy to raise a complaint through multiple channels
• Handle complaints promptly and fairly
• Keep complainants informed throughout the process
• Learn from complaints to improve our practices

How to Make a Data Protection Complaint

You can submit a complaint to the GWG through any of the following:

• Email
• Post
• Phone via the BBC Pension and Benefits Centre 

You do not need to use formal language. Any expression of dissatisfaction about how we have handled your personal data will be treated as a complaint.

Time limits for submitting a data protection complaint

• If you want to make a data protection complaint, then you should do so within three months of becoming aware of the issue. Section 5 Data Protection Complaints details this process.

• If you are unhappy about how we’ve responded to your subject access request (SAR), then you should do so within 40 working days. Section 6 Subject Access Request (SAR) Internal Reviews details this process.

Waiting longer than these prescribed time limits could affect our ability to investigate your complaint. In some cases, a long delay will mean that we will not consider the matter at all.

The GWG may still consider complaints submitted outside these time limits where there are extenuating circumstances and it is reasonable to do so. To ensure that serious concerns are not excluded solely because the time limit has expired, the GWG may consider older complaints where:

• there is an ongoing risk of harm to data subjects
• there are safeguarding concerns, for example where the complaint relates to the processing of children’s or vulnerable adults’ personal data
• there is evidence of a systemic failure

Data Protection Complaints

If you are concerned about how the GWG has handled your personal data, you can submit a data protection complaint. The GWG has a two-stage internal complaints process, followed by the right to complain to the UK data protection regulator, the Information Commissioner’s Office (ICO):

1. Initial review
2. GWG Trustee review
3. ICO escalation

Stage 1: Initial Handling 

What happens:

• We acknowledge your complaint promptly and provide a reference number
• We review your complaint and may contact you for clarification
• We investigate by reviewing any records relating to your complaint and contacting relevant BBC teams
• We keep you updated at key stages
• We aim to respond as promptly as practicable and ordinarily within one month. More complex complaints may take longer 

There is likely to be a wide range of factors that influence how long your investigation takes. This can include the following:

• the complexity of the issue
• the scale of the issue
• any harm that the complainant is suffering because of an unresolved issue

The time it takes to investigate and complete your case is indicative and may change depending on the above.

The investigation:

The GWG is required to make reasonable and proportionate enquiries, having regard to the circumstances of each complaint.

We will investigate your concerns and assess compliance with all relevant data protection legislation and regulation (such as the UK GDPR, the DPA 2018, the DUAA 2025, and the PECR 2003), ICO guidance and GWG policies. 

The Outcome:

You will receive a written response explaining:

• what we found
• any actions taken
• our outcome, including information about escalation to the GWG Trustees

Stage 2: GWG Trustees Review

If you are not satisfied with the Stage 1 response, you can ask for the complaint to be escalated to Stage 2 for review by the GWG Trustees.

How to escalate:

• Contact the GWG Trustees to request escalation within 30 calendar days of receiving the Stage 1 response

What happens:

The GWG Trustees will:

• conduct an independent review of the complaint
• request further information from the data subject or internally, where necessary
• issue a final outcome within three (3) months (unless your case is complex), including information about escalation to the ICO. Complex complaints may take longer to investigate 

Escalation to the Information Commissioner’s Office (ICO)

If you remain dissatisfied after Stage 2, you have the right to complain to the ICO.

While you can complain to the ICO at any point, the ICO may expect individuals to have attempted to resolve concerns directly with the organisation before seeking regulatory intervention. The ICO has published its Data Protection Framework which sets out how they handle data protection complaints, including how they determine if they will investigate a complaint.

ICO contact details:

• Website: ico.org.uk/make-a-complaint
• Phone: 0303 123 1113
• Address: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Subject Access Request (SAR) Internal Reviews

If you are unhappy with how the GWG has responded to your Subject Access Request (SAR), you may request an internal review by the GWG Trustees. The purpose of the review is to independently assess whether your SAR was handled fairly, lawfully and in accordance with applicable data protection law, ICO guidance and GWG procedures. 

Requesting a SAR Internal Review

Requests for a SAR Internal Review should normally be made within 40 working days of receiving the SAR response. Requests submitted after this timeframe may not be accepted.

Information about how to request a review will be included in the SAR response.

SAR Internal Review Process 

The GWG has an internal review process, followed by the right to complain to the UK data protection regulator, the Information Commissioner’s Office (ICO):

1. GWG Trustees review
2. ICO escalation

What the Internal Review Covers

The internal review will consider matters such as:

• how the SAR was interpreted and scoped;
• whether reasonable and proportionate searches were carried out;
• whether any exemptions or restrictions were appropriately applied;
• whether the response was provided within applicable timeframes; and
• whether communications were handled clearly and appropriately.

The review is not intended to repeat the original SAR process or automatically rerun searches. However, where appropriate, the GWG may take additional steps or provide supplementary information if issues are identified during the review.

Outcome of a SAR Internal Review

The GWG will provide a written outcome explaining:

• the findings of the review;
• whether the original SAR response is upheld or amended; and
• any further action the GWG considers appropriate.

The GWG aims to complete SAR Internal Reviews as promptly as practicable and ordinarily within three months, although complex cases may take longer.

Escalation to the Information Commissioner’s Office (ICO)

If you remain dissatisfied following the SAR Internal Review, you have the right to complain to the ICO.

ICO contact details:

• Website: ico.org.uk/make-a-complaint
• Phone: 0303 123 1113
• Address: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Accessibility and Support

The GWG will provide reasonable support to help you make a complaint, including alternative formats or assistance where needed.

Monitoring and Improvement

• All complaints are logged and tracked
• Trends and outcomes are reviewed by the GWG Trustees
• Lessons learned are used to improve data protection practices

Contact Details

GWG Trustees

• Email: bbcgwg@bbc.co.uk
• Post: BBC Pension and Benefits Centre, Broadcasting House, 3 Central Square, Cardiff, CF10 1FT

Policy Review

The GWG will review this Data Protection Complaints Policy every two years, or sooner where necessary to reflect changes in legislation, regulation, or guidance issued by the ICO.