1. Purpose 

This is the data protection complaints policy of the Advertising Standards Authority Limited (ASA), the Advertising Standards Authority (Broadcast) Ltd (ASA(B)), the Committee of Advertising Practice Limited (CAP) and the Broadcast Committee of Advertising Practice Limited (BCAP), all companies with a registered office at Castle House, 37-45 Paul Street, London, EC2A 4LS and registered as data controllers with the Information Commissioner’s Office. These entities are referred to as “we” or “us” in this policy.  

The policy sets out how we handle complaints concerning our processing of personal data. It is adopted to comply with section 164A of the Data Protection Act 2018 (the DPA 2018), as inserted by section 103 of the Data (Use and Access) Act 2025. Section 164A requires data controllers to maintain a process through which individuals may complain about alleged infringements of data protection legislation relating to their personal data. 

For more information about how we collect, use and protect personal data, please read our Privacy notice.

2. Scope

This policy applies to complaints alleging that we have infringed: 

  • the UK GDPR; 
  • the Data Protection Act 2018 (where applicable); or 
  • other applicable UK data protection legislation. 

This policy does not apply to complaints about regulatory decisions, service quality, or staff conduct, which are dealt with under separate policies.  

3. Right to complain 

Any individual who considers that we have infringed data protection legislation in relation to their personal data may make a complaint. 

Complaints should be submitted by email to [email protected]. However, if you wish to submit your complaint by post, or by any other reasonable means, please let us know so that we can facilitate this. 

A complaint does not need to be labelled as a “data protection complaint” if it is clear that the individual is expressing dissatisfaction about the handling of their personal data. 

4. Acknowledgement 

We will acknowledge receipt of a data protection complaint within 30 calendar days of receipt, as required by section 164A DPA 2018. 

5. Investigation 

We will take appropriate steps to investigate the complaint. 

This may include: 

  • reviewing relevant records; 
  • seeking information from staff, contractors or processors; 
  • requesting clarification from the complainant; and 
  • considering whether remedial action is required. 

The complainant will be kept informed of progress where appropriate.

6. Outcome

We will notify the complainant of the outcome without undue delay following completion of our investigation, as required by section 164A DPA 2018. 

The response will normally: 

  • summarise the complaint; 
  • set out findings; 
  • explain any action taken or proposed; and 
  • provide information about further rights of redress. 

7. Information Commissioner's Office 

If a complainant remains dissatisfied, they may complain to the Information Commissioner's Office. 

We will provide information about this right when communicating the outcome of a complaint. 

8. Governance and Records 

The Director of Corporate Services is responsible for oversight of this policy. 

We will maintain records of: 

  • complaints received; 
  • acknowledgement dates; 
  • investigations undertaken; 
  • outcomes; and 
  • corrective actions implemented. 

9. Review 

This policy will be reviewed annually and whenever changes to applicable law or regulatory guidance make revision necessary. 

This policy was published on 11 August 2026.