Menu

Our privacy notice: What happens to the information you give us

This privacy notice explains how we use and look after information about you, or that could identify you. 

We manage all the personal information we hold in accordance with the UK General Data Protection Regulation and the Data Protection Act 2018.

If you have any further queries, please email the Data Protection Officer dpo@Ombudsman.org.uk.

We are registered with the Information Commissioner's Office (ICO) as a Data Controller. Our registration number is Z6520944. 

Download the EasyRead version of our privacy policy [PDF, 3 MB]

What information do we collect about you?

When you first contact us, we will record your name, address, telephone number, email address and details of your complaint along with any other information you choose to tell us about yourself, or the person affected by the complaint in a file:

  • on a computer
  • on paper
  • in the cloud (on internet servers)
  • all of the above.

If you contact us by telephone, we may record the call we have with you and retain a copy of this. When this happens you will be told about it and you will be able to request a copy of the recording or the written version of it.

Why we collect this information

  • We consider complaints about government departments, other public organisations in the UK and the NHS in England, where you believe they have not acted properly or fairly or have provided a poor service. So that we can do this we need to collect and use information about you and your complaint. 

Sharing your information when you first contact us

  • We will treat your information considerately and confidentially. However, we will need to share some information about your complaint with the organisation you have complained about. By making your complaint, you agree that we can share information about you and your complaint. 
  • If you do not want us to share the information you have given us with the organisation you have complained about, please tell us straight away. Please be aware, however, that this is likely to limit our ability to investigate your complaint. 

Why we share your information

  • We may talk to the organisation that you have complained about so we can learn more about what happened and how they responded to your complaint to them. As the Ombudsman is the final stage in the complaints process, we will want to understand the history of your complaint. 
  • This will help us decide how to handle your complaint. 
  • We might also ask for advice about your complaint from someone with specialist knowledge (for example, a psychologist, midwife or obstetrician). We work with qualified medical professionals to provide expert and independent knowledge. Find out more about How we use clinical advice to inform our decisions.

Sharing your information if we do not investigate your complaint 

  • Sometimes we can help to put things right without an investigation. There might be other reasons why we cannot help you further with your complaint. If so, we will write to you or your MP (if you have complained about a government body) explaining why we are not investigating your complaint. 
  • We may send details of this final letter to the organisation or person you complained about. This is to help them learn from the complaint and to consider if they need to do things differently or better. 

Sharing your information so we can investigate your complaint

  • If we decide to investigate your complaint, we must tell the organisation and any person complained about. We will therefore need to share your name and the details of your complaint. 
  • At the same time, we will usually ask the organisation for more information (including relevant papers and computer records). This can include very sensitive information such as your health records. 
  • We can also ask for information from anyone who we think can help us with your investigation. This could be someone with specialist knowledge (such as a psychologist, midwife or nurse) or someone who can tell us more about what happened and the impact it had on you (such as a relative or an employer). 

Investigating with the Local Government and Social Care Ombudsman 

  • Sometimes complaints are about both health and care. For example, complaints about older people whose care is being jointly provided by social care and health services. In these cases, we may carry out a joint investigation with the Local Government and Social Care Ombudsman (LGSCO). 
  • This will mean sharing your information with them. If we do need to work with the LGSCO we will ask for your consent first. 
  • If you consent to both organisations dealing with your complaint, you are also giving your consent to the organisations sharing your information if they need to. For specific details on how we and the LGSCO carry out a joint investigation and details of the Data Protection Officer please see our joint working agreement. 

Sharing draft and final reports on an investigation 

  • Towards the end of our investigation, we will send you and the organisation, and any person complained about, a copy of our initial view (which we call provisional view). This gives you both a chance to comment on our draft findings. 
  • Our draft report is confidential. It will contain all the information from you and others that we have contacted. You and the organisation may share the draft report with people who can help you comment on its accuracy and content (for example, a family member or professional adviser), but by law you and the organisation complained about must not make the contents public. 
  • After we receive comments on the draft report, we will send a final report to:
    • you 
    •  your MP (if your complaint was referred to us by the MP) 
    • the organisation and any person complained about. 
  • Once you and the organisation have received the final report, it is up to you both how you use it. You both must, however, be aware of any information within the report that can identify you or any other person and handle it with care. 
  • If we think that your complaint provides insight into how services or organisations can improve or is in the public interest, we will share our findings with: 
    • regulatory organisations (such as the Care Quality Commission, General Medical Council or Monitor) if we have identified a problem that may affect others 
    •  any other appropriate organisation that may benefit from what has been learned from our report. 
  • Before we send any information or reports about your complaint we will remove any information about you or information that may enable you to be identified. 
  • Unless we decide to publish the report, we will not normally discuss its contents with anyone other than those involved in the investigation. There is more information about our published reports later in this policy. We will make sure people who make complaints cannot be identified from our published reports. 

Using your information to improve public services and for training and monitoring purposes 

  • We want to make sure we provide a good service, so we may use your complaint for training, monitoring and evaluation purposes or invite you to meetings where we explain more about the Ombudsman’s roles and responsibilities, and ask for your feedback. We will only share any information you provide with our staff or people acting on our behalf.
  • For example, we run a feedback survey. The information you provide in the online survey will be shared with the survey company Opinion Research Services (ORS). This will not include your name but will include information that could make you identifiable.
  • We may also share your contact details with ORS so they can contact you to complete the phone version of the survey. ORS will get in touch with individuals who have not completed the online survey on a randomly selected basis. Not everyone will be contacted but you may be invited to provide feedback.
  • Please note, you may still receive a phone call from ORS if you opt in to complete the survey but then inform us that you do not want us to pass on your contact details after they have already been sent to ORS. However, your contact preferences will be updated on our systems as soon as we become aware of this.
  • We publish the results from these surveys in an anonymous format each quarter on our website. Any personal data you provide will be confidential and only accessible to PHSO and ORS.
  • The survey company will destroy any information which identifies you as an individual three months after the closure of that year’s survey. This could be up to fifteen months after you have given your feedback. We will then keep this information for up to one year.
  • As you have the right to be forgotten (also known as the right to erasure), if at any time you want to withdraw your feedback, please contact the information rights team at informationrights@ombudsman.org.uk 
  • The law allows us to use your contact details in this way. This is known as legitimate interest. If you do not want to take part please tell your caseworker, call us on 0300 061 4222, or emailsurvey@ombudsman.org.uk
  • You can change your mind at any time, and this will not have any impact on how we handle your complaint.

Information for public sector organisations 

  • From time to time, we may invite people to take part in targeted surveys. This could be to understand the impact of our work on complaint handlers or clinicians. When we do this, we will only use your professional contact details such as your work email address. All surveys will either be stored within our UK hosted, secure survey software (Snap Surveys) or be conducted by a trusted survey company (Opinion Research Services). Participating is entirely voluntary and we will never ask you for personal information. 

Transfers of information overseas 

  • In certain circumstances it may be necessary to transfer personal information overseas. If we need to use an organisation or expert outside the United Kingdom, we will conduct a full privacy assessment.  

How long will we keep your information? 

  • We will keep all information about you and your complaint for two years after making our decision. This is whether we investigate your case or not.  At that point, we will delete most of your information except the following, which we keep permanently:
    • the final investigation report; 
    • information of historical significance; 
    • complaints subject to ongoing legal proceedings; 
    • enough information to be able to identify you if you re-open or decide to begin a second complaint. This includes your name, your address, the name of the organisation you complained about, what you complained about, and the outcome. This is so we do not answer the same complaint twice. 
  • If you use our online form to start the complaints process and submit it to us, we will save that information electronically. You can create an account to be able to save and view any forms you have created. 
  • If you start but don’t complete and send your complaint form to us, we will assume that you do not wish to continue with your complaint. If so, we will keep the information you submitted online for 90 days before deletion. 

Information we publish information about our work 

  • Our investigations resolve complaints on an individual basis, but they also provide an overview of issues other organisations can learn from. 
  • We share this learning by reports about particular subjects such as mental health or eating disorders. 
  • We present thematic reports to Parliament and publish them on our website. Other than in exceptional circumstances, we always remove any information that identifies you. 
  • We publish our casework decisions on our website. This includes:
    • when we make a decision not to take your complaint further 
    • the final report into the complaint. 
  • We will always remove any information that identifies you before we publish. 
  • We publish our decisions to help people understand what we do, how we do it and what to expect from us. 
  • Being transparent enables individuals and organisations to see how we may remedy complaints and improves public service as organisations learn from others. It also helps people who are not sure if they can bring a complaint to be more confident to come forward. 
  • This is why we publish decisions we have upheld and those which we have not, as well as primary decisions when we decline to investigate. Publishing casework means telling our complainants' stories. In doing so we create learning opportunities for the organisations we investigate and inform the public about PHSO’s vital work.
  • We also publish a disclosure log. This is so everyone can see responses to questions we have been asked by the public under the Freedom of Information Act (FOI).

Signing up to our email updates

We use a third-party supplier to provide email updates about our work. If you choose to subscribe to this service your name and email address will be shared with them.

The third-party supplier handles this data on our behalf and meet the requirements of data protection law in how they obtain, handle and process your information. They will not make your data available to anyone other than PHSO without your permission.

You can unsubscribe from our email updates at any time by clicking the link at the bottom of the email or through our third-party supplier website.

How we can process your information

  • We are allowed to use your information for the purpose of handling your complaint under our legislation. This legislation also protects information obtained for the purposes of investigating your complaint. 
  • The UK GDPR requires us to have a lawful basis to process your personal data. This is article 6(1)(e) of the UK GDPR, which allows us to process personal data when this is necessary to carry out our work.
  • To investigate your complaint we may also process more sensitive information called special category data, such as health, religious or ethnic background information. The lawful basis we rely on to process it is article 9(2)(g) of the UK GDPR, which also relates to our functions as an Ombudsman and the safeguarding of your fundamental rights, and Schedule 1 part 2(6) of the Data Protection Act 2018 which relates to our powers set out in our legislation.
  • To meet our legal duties under the Equality Act (2010) we will make reasonable adjustments to enable you to access our service. The lawful basis we rely on to process this information is article 6(1)(c) of the UK GDPR which states we can do this where there is a legal requirement for us to do so.

Your rights

You have rights under the General Data Protection Regulation (GDPR): 

  • You have the right to be informed about how we use your information. This is called a privacy notice and you’re reading an example 
  • You have the right to request a copy of information we hold about you and this is free of charge. 
  • We may however not be able to give you the information you are after if, for example, if it contains personal information about other people, we are in the middle of an investigation, or if the information has been given to us in confidence. 
  • If you would like a copy of some or all of the personal information we hold about you, you can ask the person handling your complaint, or contact our Freedom of Information and Data Protection Team by emailing informationrights@ombudsman.org.ukor writing to:

    Information Rights
    Office of the Parliamentary and Health Service Ombudsman 
    CityGate 
    47-51 Mosley Street 
    Manchester 
    M2 3HQ 
  • If you think we have got your details wrong, please let us know and we will update them within one month. 
  • You have the right to ask us to delete your personal data. This is sometimes known as the right to be forgotten or the right to erasure. 
  • If the data you are asking us to delete was information to investigate and resolve your complaint, we may not be obliged to erase this information. This is because the right to erasure does not apply information which we hold to fulfil our official functions as detailed in our legislation (also known as public task). 
  • If we do agree to your request to delete your information, may need to keep enough information to make sure that we honour your request. In some cases, we need to keep your information even though you have made a deletion request, also known as the right, to be forgotten. This is when we are bound by law to keep information for longer. 
  • If you want to request the deletion of your personal data you can email informationrights@ombudsman.org.ukor write to: 

Information Rights
Office of the Parliamentary and Health Service Ombudsman 
CityGate 
47-51 Mosley Street 
Manchester 
M2 3HQ 

  • You have the right to ask us to not use your personal information for certain purposes. You may, for example, not want your information to be shared with the LGSCO, or to take part in feedback. We will retain just enough information about you to make sure your wishes are respected in the future.  
  • If you want to object to how your personal data is used, you can email informationrights@ombudsman.org.ukor write to: 

Information Rights
Office of the Parliamentary and Health Service Ombudsman 
CityGate 
47-51 Mosley Street 
Manchester 
M2 3HQ 

  • We will not sell your information or use it for commercial purposes.

Freedom of information

  • We are a public authority under the Freedom of Information Act 2000 (the FOI Act). We will not release information we hold about you to other people under this Act. This is because we cannot release any information we obtain about a complaint unless we need to do so to carry out our work. 
  • Under the Freedom of Information Act 2000 and the Environmental Information Regulations 2004 you have a right to request any recorded official information held by us. The information you require may already be publicly available and we have a duty to make official recorded information available. 
  • We make information available via a publication scheme. Before you make  a request please check the publication scheme. 
  • If you need to make a request, it must be done in writing.  You can email: InformationRights@ombudsman.org.ukor write to:  

    Information Access & Assurance
    Office of the Parliamentary and Health Service Ombudsman 
    CityGate 
    47-51 Mosley Street 
    Manchester 
    M2 3HQ 
  • You do not need to say why you want the information. Your request must include your name, and an address for correspondence (email address is fine). Please make it clear what information you require. With certain exceptions, you are entitled to a response within 20 working days. There is no charge for making a Freedom of Information request. 
  • However, we can refuse to deal with your request if: 
  • We do not hold the information you have requested 
  • The information is exempt from disclosure 

Changes to our privacy notice

  • We keep our privacy notice under regular review. This notice was last updated in March 2024.

Complaints, comments and compliments 

  • If you wish to make a compliment, comment or complaint about how the PHSO are processing your data, then please contact the Data Protection Officer at dpo@ombudsman.org.uk 
  • If you are still unhappy with how we have handled your complaint, you may contact the Information Commissioner's Office. The Information Commissioner Wycliffe House Water Lane Wilmslow Cheshire SK9 5AF Phone: 08456 30 60 60 Website: ico.org.uk
  • If this privacy notice changes in any way, we will place an updated version on this page. 
  • For information on how our website uses cookies please see https://www.ombudsman.org.uk/cookies

How to contact us

Please get in touch if you have any questions about our privacy policy or information we hold about you. Please email: dpo@ombudsman.org.uk

Contact details for the PHSO Data Protection Officer:

Alex Daybank 
Data Protection Officer
Office of the Parliamentary and Health Service Ombudsman
CityGate
47-51 Mosley Street
Manchester
M2 3HQ

Further information

  • If you want to know more about our commitment to keeping your information safe, read our Information Promise. 
  • For more information about your rights under the Freedom of Information Act 2000 and the General Data Protection Regulation, see the Information Commissioner's website at ico.org.uk
  • If you want to make a request for information, please contact: informationrights@ombudsman.org.uk
  • Our publication scheme gives details of all the information we make freely available to the public. It includes our records management policy and casework retention schedule.