I am often asked how many complaints the Information Commissioners Office (ICO) need about a company before they start to take action. There is no definitive answer. I have known companies have as few as 12 complaints raised with the ICO before they start to make enquiries into a businesses practices. It is easy for someone to complete the online form and raise a "concern" with the ICO. When the ICO starts to investigate your practices, it can take up to six months to resolve the queries raised and receive a conclusion from the ICO as to what action they intend to take against your business.
If you are working on the basis that you won't improve your information security practices until the ICO starts to take an interest, you might not have to wait long. Data Protection is becoming more high profile and, as can be seen from the bad publicity, something that is featured in the news on a regular basis. The outcome of any investigation will depend on the type of complaint, number of complaints and the personal information involved. We regularly provide support to businesses as they go through the investigation process.
What would you do?
No comments:
Post a Comment