Who can make a complaint and what consent do you need

Promoting a just and learning culture  

• Senior leaders make sure colleagues are supported and trained in all aspects of dealing with complaints, from identifying a complaint to issuing a response, so that they meet the expectations set out in the Complaint Standards. This should include how to manage challenging conversations and behaviour. 

Welcoming complaints in a positive way 

• Organisations clearly publicise and promote how service users can raise complaints in a range of ways that suits them and meets their specific needs. They make it easy for everybody to understand how the process works. This includes being clear about who can make a complaint and what will happen next. 
• Organisations make sure service users know how to get advice and support when they make a complaint. This includes giving details of appropriate independent complaints support and advice providers and other support networks. 
• Organisations regularly promote their wish to hear from service users and show how they use learning from all feedback (including complaints) to improve services. 

The Information Commissioner’s Office refers to Article 4(11) of Regulation (EU) 2016/679 (United Kingdom General Data Protection Regulation), which defines consent as: 

‘Any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.’ 

Tip 

If you are dealing with a complex situation and are not sure what to do, contact your organisation’s legal or information rights team or the Information Commissioner's Office (ICO) for advice.    

Most complaints are made by the person who received the service they are complaining about, or by someone who has been affected by something you have or have not done, or a decision made by your organisation.   

• When you receive the complaint, the first step is to explain to the person who has brought the complaint what you will do to look into their complaint. As part of that, you should tell them that you will need to look at any relevant records held by your organisation, including their personal information. Get their written consent to do this, and keep it with the complaint records. 
• Explain that some people inside (and potentially outside) your organisation may need to see this information as part of your investigation and response to their complaint. See the sample consent forms.

If the person directly affected does not want to complain themselves, they can ask someone else to complain on their behalf. This representative will then act on their behalf throughout the process.   

A representative can be anyone, and there is no restriction on who can act as a representative. They might be: 

• a family member 
• a friend 
• an advocate 
• a legal representative 
• an MP or local councillor 
• someone else. 

If the person is using a representative, you need to follow confidentiality and data protection laws. The person needs to authorise the representative to act on their behalf. They must also give you consent to discuss their complaint and share their personal information with the representative. See the sample consent forms.

• If the person affected does not want you to discuss the complaint with their representative, you need to consider whether there are any issues in the complaint that relate to the representative. If there are, you can consider those issues because the representative will then be making the complaint on their own behalf.  
• Explain to the representative that you can investigate only the issues that directly affect them. Without the consent of the other person involved, you will not be able to investigate any matters relating to them or share personal information about them. This may leave some of the person’s concerns unanswered. 

If the child has sufficient maturity and understanding, they can either make the complaint themselves or consent to a representative making the complaint on their behalf.   

• If a child wants to make a complaint and you judge that they do not understand what is involved, someone with parental responsibility can make a complaint on their behalf. In these circumstances, you do not need consent from the child or from the other parent or guardian.  
• Explain the process to the child in a way that they can understand, as far as possible. This includes telling them that you may need to share information from records your organisation holds (and possibly other relevant records) with the people looking into the complaint, and with the person making the complaint. 

If the person affected does not have the capacity to consent to the complaint being made on their behalf, you need to: 

• check whether the person making the complaint has a legitimate interest in the person’s welfare
• assess whether there is a conflict of interest
• find out if the person making the complaint has a right to access the person’s personal information. For example, do they have Power of Attorney and so have authority to manage the person’s property and affairs? Or have they been appointed by the Courts to make these decisions? If not, you need to establish right of access
• when you have the information about the right of access to relevant personal information, add this to your records
• even if you deal mainly with the person who has made the complaint, you should update the person themselves about any investigation, where possible. 

Here's a sample consent form.

Find out more 
See the Information Commissioner’s guide to accessing personal data. 

Your duty of confidentiality to service users continues after their death.   

If the person has died, their personal representative or the legal executor of their estate will control access to any personal information. However, if anyone has a potential claim arising out of their death, such as family and friends named in a will, they too may be entitled to access the person’s information (see the Access to Health Records Act 1990).  

• Add the right of access to the relevant personal information to the complaint records.  
• If the person complaining is not the personal representative, executor or someone with legal access to their records, investigate the complaint and report on it without releasing confidential personal information. 

Here's a sample form to use if someone cannot provide consent.

There are no restrictions on who can complain. But if the person making the complaint does not have right of access to personal information, there are some restrictions on the type of information you can share when you respond to a complaint. 

• At the start of the process, explain the situation to the person making the complaint.  
• Say that you can investigate the matter, but that there will probably be a limit to the amount of information that you can share during the investigation. Explain that this may also limit what you can include in the response and this may leave some of their concerns unanswered. 
• Ask the person making the complaint if there is someone who has a right of access to the person’s information who could make the complaint instead. If so, that person could appoint the original person complaining to continue progressing the complaint on their behalf as a representative. 
• If there is no one with right of access, ask the person making the complaint if they would still like you to continue with the investigation on the understanding that you will not be able to share personal information. 

If you believe a representative is not acting in the best interests of the person affected, think about whether to stop working on the complaint. If you choose this option, you need to: 

• share your reasons with the representative in writing
• tell them that if they are unhappy with your decision, they can complain to the Parliamentary and Health Service Ombudsman via their MP.