OfS privacy

At the OfS, we’re committed to meeting our obligations under data protection legislation.

If you believe that we have not complied with data protection legislation in the way we have handled your personal information, you can submit a data protection complaint.

Data protection complaints are considered by our Knowledge and Information Management team, which operates this process separately from any other OfS complaints scheme.

What is covered by the data protection complaints scheme?

The data protection complaints scheme covers complaints where an individual considers that the OfS has infringed the data protection legislation in relation to their personal data. This may include, but is not limited to:

• how a data subject rights request has been handled, including the outcome of the request
• the security measures we have put in place to protect personal data
• the handling of personal data that has resulted in a personal data breach
• how personal data has been managed or processed (e.g. in line with the data protection principles).

What is not covered by the data protection complaints scheme?

We cannot deal with matters that are not considered data protection complaints, including:

• requests for internal review made under the Freedom of Information Act 2000, the Environmental Information Regulations 2004 or the Re-use of Public Sector Information Regulations 2015 (see our page on requesting an internal review for further information)
• complaints about how another organisation or entity has handled personal data, unless we have a legal obligation to consider the matter
• decisions in relation to regulatory matters or the process we have followed to reach those decisions
• disputes between individual students or groups of students and their university or college
• matters that that could be considered under any other OfS complaints procedure (see our page on complaints about the OfS for further information).

How to make a data protection complaint

You can make a data protection complaint to us in writing or verbally. You can call our general enquiries line on 0117 931 7317, or send it to us by post or email. The address is:

Data Protection Officer
Westward House
Lime Kiln Close
Stoke Gifford
BRISTOL
BS34 8SR

Email: [email protected]

What happens once I make a complaint?

We will acknowledge receipt of your complaint, usually within five working days. 

Before starting our investigation into your complaint, we may ask you to confirm your identity. If you are raising a complaint on behalf of someone else, we may also ask you to demonstrate that you’re authorised to act on the other person’s behalf.

As part of our complaint handling procedure, we may ask you to provide further information to help us understand the nature of your complaint, so that we can fully investigate it.

Once we have concluded our investigation, we will write to you to inform you of the outcome. There are three possible outcomes to the complaints process:

• Upheld.
• Partially upheld.
• Not upheld.

We will let you know what has been done to resolve the issues identified, and, where appropriate, any actions taken as a result.

If you’re not satisfied with our response

If you are not satisfied with the outcome of your complaint, you can submit a complaint to the Information Commissioner’s Office (ICO).

Privacy information

We process complaints in accordance with the requirements of data protection legislation. For further information about how and why your personal data is processed, please refer to the ‘Information rights requests’ section of our general privacy notice.