Skip to main content
Hafan

UK Extension to the EU-US Data Privacy Framework complaints tool

Find out how to raise a complaint about the transfer of your personal information from the United Kingdom to the United States of America under the UK Extension to the EU-US Data Privacy Framework (UK Extension), or what to do if you believe a US business is falsely claiming to be signed up to the UK Extension. 

Also find out how to raise a complaint about the access of your personal information by a US Government entity (including the US Intelligence Community) after it has been transferred to the US from the UK, either using the UK Extension or any other transfer mechanisms.

Before making a complaint

If you want to raise a complaint about a US business handling your personal information under the UK Extension, you should check that they are registered on the Data Privacy Framework (DPF) website, unless your complaint is about a US business falsely claiming to be registered under the UK Extension.

This does not apply if you are making a complaint about the access of your personal information by a US Government entity (signal intelligence activities) following a transfer from the UK to a US organisation.

If you do not provide the information we need, your complaint may be delayed.

Making a complaint

About a US business signed up to the UK Extension

If you want to complain to us about the handling of your personal information by a US business that has signed up to the UK Extension, you should give that business a chance to sort things out before you come to us. If they do not do that, or you are unhappy with their response, you’ll need to provide us with:

  • copies of any letters or emails about your complaint between you and the US business; and
  • any other evidence that supports your complaint.

If you want to complain to us about a US business you believe is falsely claiming to be signed up to the UK Extension, you will need to provide:

  • the name of the US business,
  • the website address; and
  • (optional) images showing where it makes this claim.

If you are acting on behalf of someone else who wants to bring a complaint, you will need to send us a letter of consent signed by them or evidence that you can act on their behalf.

About access by US Government entities

You can complain about a US Government entity (including the US Intelligence Community) unlawfully accessing your personal information for signals intelligence purposes, after it has been transferred from the UK to a US organisation (either using the UK Extension, or any other transfer mechanisms). The complaint must relate to an event which took place after 12 October 2023. You'll also need to provide specific information in your complaint:

  • who you are, or details about the person you are acting on behalf of;
  • the specific means by which, or reasons why you believe, the personal information about you or the person you represent was transmitted to the USA (such as an email address, phone number or other details provided as part of another transaction, online or not);
  • why you believe the information about you or the person you represent has been subject to signals intelligence activities (as defined in the USA) after it has been sent from the UK to the USA;
  • when this transfer and subsequent access by US Government entities may have taken place (must be after 12 October 2023);
  • the names of the US Government entities believed to have accessed this information (if known);
  • whether you believe this access violated the US Constitution or other relevant US laws, orders, policies or procedures relating to US signals intelligence activities and privacy and civil liberties safeguards;
  • whether  you believe this access adversely affects either your rights or privacy and civil liberty interests or those of the person you represent;
  • any other attempts you have made to resolve the matter and the response you received; and
  • the outcome you are looking for.

You do not need to show that US Government entities have in fact accessed your personal information.

We may ask for further information to satisfy us of your identity. If you are acting on behalf of someone else who wants to bring a complaint, you will need to send us a letter of consent signed by them or evidence that you can act on their behalf.

Further reading

Find out more about the process and potential outcome of your complaint about a US business under the UK Extension to the EU-US Data Privacy Framework, or about US Government entities.