Complaints about personal data

We take the protection of personal data seriously. If you have concerns about how we have collected, used, shared, stored or otherwise handled your personal data, or how we have responded to your data protection rights, you have the right to make a complaint to us.

Under data protection law, you are expected to raise your concern with us first so that we have the opportunity to investigate and resolve the issue. However you do also retain the right to complain to the Information Commissioner’s Office (ICO) at any time.

What is a data protection complaint?

A data protection complaint is any expression of dissatisfaction about how we process personal data or how we have handled your information rights. You do not need to use legal terms or refer to legislation for us to treat your concern as a complaint.

Examples include concerns about:

  • how your personal data has been collected, used or shared
  • how long we retain your personal data
  • how we keep your personal data secure
  • how we have responded to a request to exercise your rights
  • delays in responding to a rights request
  • the accuracy or lawfulness of processing

How to raise a data protection complaint

You can raise a complaint with us in the way that is easiest for you. For example, you can contact us:

  • Email: DPA@transport.gov.scot
  • Telephone: 0141 272 7100
  • Post: Transport Scotland, 177 Bothwell Street, Glasgow, G2 7ER

You may also raise a complaint through other contact routes, including with any member of staff. We will treat your concern as a data protection complaint wherever it is received.

Your complaint will be handled by our Data Protection and Information Governance team.

If you require this information in an alternative format or need support to make a complaint, please let us know and we will make reasonable adjustments.

How we handle your complaint

Stage 1: Receipt and acknowledgement

We will acknowledge your complaint without undue delay, normally within 5 working days of receiving it and no later than 30 calendar days as set out in Data Protection law.

Stage 2: Investigation

We will take appropriate steps to investigate your complaint without undue delay, make any necessary enquiries and keep you informed of progress during our investigation.

Stage 3: Outcome

We will provide you with a clear response setting out the outcome, explain any action taken and explain the reasons for our decision. We aim to provide a full response within one calendar month. If your complaint is complex and this is not possible, we will keep you informed.

If you are not satisfied

If you are dissatisfied with our response, you can request an internal review within 20 working days using the contact details provided above. We aim to complete reviews with one calendar month.

You also have the right to complain to the Information Commissioner’s Office (ICO). Helpline: 0303 123 1113

How we use your information

We will process your personal data for the purpose of handling your complaint in line with data protection law. We will only use your information to investigate and respond to your complaint, only share your information with staff involved, and keep a record of your complaint.

Learning from complaints

We keep records of complaints and use this information to help improve our services, processes and compliance with data protection law.