1. Purpose and scope
Part A explains how to complain about the Guild, and what happens next. Part B explains how to ask for your personal data, or ask us to correct, delete or restrict it. It also explains how we handle that request.
Reports about a person's behaviour follow the Code of conduct. The Code has its own confidentiality and independence rules. Concerns about wrongdoing inside the Guild follow the Speaking up policy.
Defined terms
Subject access request (SAR or DSAR): a request for a copy of the personal data we hold about you.
Working day: Monday to Friday, excluding English bank holidays.
Part A: Complaints
A1. Scope
Any complaint about the Guild is covered. That includes its events, its website, its communications, its handling of personal data, and its conduct as an organisation.
A2. How to complain
Code of Conduct, risk and compliance matters: report@manchesteraiguild.com. This reaches Edwin Luther, the Guild's reporting and escalation contact.
Personal data matters: the Data Protection Lead at report@manchesteraiguild.com.
Post: Manchester AI Guild Ltd, 1 Southern Road, Sale, M33 6HP.
Tell us what happened, when, and what you would like us to do. You do not have to use the form or any particular words. If you are not sure which address to use, use either one. We pass your message to the right person.
Under section 164A of the Data Protection Act 2018, anyone may complain to the Guild about how we handle their personal data. People can complain by email to report@manchesteraiguild.com or to any SLT member. We acknowledge every complaint within 30 days of receiving it. If you are not satisfied with our response, step 5 in A3 explains the Information Commissioner's Office (ICO) route.
A3. What happens next
Acknowledgement within 5 working days. We tell you who is handling the matter. That is Edwin Luther for Code of Conduct, risk and compliance matters, or the Data Protection Lead for personal data matters. If the complaint is about one of these people, someone else will handle it.
Investigation. We look at the facts and speak to anyone involved. We may ask you for more detail.
Written response within 20 working days of receipt. The handling contact explains what we found and what we will do. If the matter will take longer, we tell you why and when to expect a reply.
Escalation. If you are unhappy with the response, reply within 20 working days. The route is:
the handling contact;
then Edwin Luther, as the Guild's escalation contact, unless he handled the matter or is the subject of the complaint;
then the full Senior Leadership Team (SLT), excluding anyone involved in the matter. The SLT answers within a further 20 working days.
That is the end of the Guild's internal process.
Outside the Guild. For complaints about personal data, you can go to the Information Commissioner's Office (ICO) at any time. Online: https://ico.org.uk/make-a-complaint/data-protection-complaints/ Phone: 0303 123 1113, or live chat on the same page. Section 164A of the Data Protection Act 2018 gives you the right to complain to the Guild, as A2 describes.
A4. Records
We keep a log of complaints. It records the date, type and outcome. We keep the log and the correspondence for 3 years after the matter closes, then delete them, as the Data retention schedule sets out. We use the log to spot patterns and improve. The Senior Leadership Team (SLT) reviews it each year in anonymised form.
Part B: Data subject access requests and other rights requests
B1. What you can ask for
Under UK GDPR you can ask for a copy of the personal data we hold about you. You can also ask us to correct, delete or restrict it. You can ask for it in a portable form, or ask us to stop using it in some ways. The full list is in section 8 of the Privacy notice. This procedure applies to all of these requests.
B2. How to make a request
You can make a request in any form: in person, in writing, by email, or through social media. You can make it to anyone at the Guild. We recommend email to the Data Protection Lead at report@manchesteraiguild.com, because that reaches the right person fastest.
You do not need to say "subject access request" or quote the law. If you are clearly asking for your personal data, we treat it as a SAR.
Someone can ask on your behalf, for example a solicitor or a relative, if they show they have your authority.
B3. Confirming who you are
If we are not sure a request comes from you, we ask for enough information to confirm your identity. The information we ask for is in proportion to the data involved. For most Guild records, replying from the email address we hold for you is enough.
The one-month clock (B4) pauses while we wait for your identity to be confirmed. It restarts the day after we receive what we asked for. For access requests, the clock also pauses while we wait for you to clarify what information you want (UK GDPR Article 12A(5)).
B4. How long we take
We respond without undue delay, and within one month of receiving your request. If we asked you to confirm your identity or clarify your request, the month runs from when we receive your answer. For complex or numerous requests we may extend the time by two further months (UK GDPR Article 12A, inserted by section 76 of the Data (Use and Access) Act 2025).
If a request is complex, or you have made several at once, we may extend the time. We tell you within the first month, and we explain why.
We log each request on the day it arrives, with its response due date, so nothing slips.
B5. Fees
There is no fee for a request. We may charge a reasonable fee only in two cases. The first is where a request is manifestly unfounded or excessive. The second is where you ask for further copies of information we have already given you. We tell you the fee before we do any work, and you can then withdraw the request.
B6. What we provide for an access request
A copy of your personal data from every place we hold it. That includes the join-form database, email, membership records and, where we hold them, event or Slack records. It also includes any other place we have not listed here.
The purposes we use the data for, who we share it with, how long we keep it, where we got it if it did not come from you, and your rights. These are set out in the Privacy notice.
Where a record also contains someone else's personal data, we remove or redact that part. We do not remove it if the other person agrees, or if it is reasonable to disclose it without their consent.
Where an exemption applies, for example legal privilege or information about other people, we tell you that we have withheld something and why. We do not tell you if doing so would defeat the exemption itself.
B7. How we send it
We send the information by email to the address we hold for you. It is sent as a PDF or a plain data export. If you ask for another format, or a different secure route (for example a password-protected file, with the password sent separately), we use that. If you make the request electronically, we reply electronically unless you ask us not to. We do not send personal data to an address we cannot verify.
B8. Other rights requests
Rectification: we correct the record, and tell anyone we shared it with.
Erasure: we delete the records from every location listed in the Data retention schedule, and confirm to you when this is done. If we must keep something, for example a complaint record, we tell you what we keep and why.
Restriction: we mark the record and stop using it, apart from storing it, until the matter is resolved.
Portability: we give you the data you provided under consent, in a common machine-readable format (CSV or JSON).
Objection: we stop direct marketing immediately. For other processing based on legitimate interests, we stop unless we can show compelling grounds that override your interests. If so, we explain those grounds.
Withdrawing consent: unsubscribe from any email, or tell us, and we stop sending emails.
B9. Log and review
We log every request. The log shows the date received, the type, any identity check or clarification, the due date, the date we answered, and the outcome. We keep it for 3 years. The Senior Leadership Team (SLT) reviews it each year.
B10. If you are unhappy
Tell us first. We will review how we handled your request under Part A. You can also complain to the ICO at https://ico.org.uk/make-a-complaint/data-protection-complaints/ or call 0303 123 1113.
2. Roles and responsibilities
| Role | Holder | Responsibilities |
|---|---|---|
| Primary responsibility | Edwin Luther, Risk & Governance Director | Handles complaints. Keeps the complaints log. Reports to the Senior Leadership Team (SLT) each year. |
| Secondary responsibility | Trevor Roberts, Data Protection Lead | Acts when the primary holder is unavailable, or where the matter concerns the primary holder. |
| Data Protection Lead | Trevor Roberts | Handles rights requests. Keeps the requests log. |
| Senior Leadership Team (SLT) | Manchester AI Guild SLT | Final internal stage of escalation. Reviews both logs each year. Approves this procedure and every review of it. |
| Independent QA reviewer | Any SLT member | Reviews this procedure before it goes to the Senior Leadership Team (SLT). Must be a Manchester AI Guild member who did not draft it. |
3. Further information
Email report@manchesteraiguild.com.
4. Review
This procedure is reviewed as often as is reasonable and, as a minimum, once every 12 months. It is reviewed sooner whenever something changes that affects it, for example when ICO guidance on the right of access changes.
The Senior Leadership Team (SLT) approves every review.
Before a review goes to the Senior Leadership Team (SLT), a Manchester AI Guild member who did not draft this procedure QA reviews it. The reviewer is never the author. The reviewer's name and the date of the QA review are recorded in the version history.
5. Related policies
Privacy notice · Code of conduct · Data retention schedule · Speaking up policy
6. References and sources
Information Commissioner's Office (n.d.) Make a complaint: data protection complaints. [online]. Available at: https://ico.org.uk/make-a-complaint/data-protection-complaints/ [Accessed 2 November 2026]. Quote: "call us on 0303 123 1113 or live chat with us".
Information Commissioner's Office (n.d.) Getting copies of your information (subject access request). [online]. Available at: https://ico.org.uk/for-the-public/getting-copies-of-your-information-subject-access-request/ [Accessed 2 November 2026]. Quote: "Organisations usually have one month to respond to a SAR."
Data Protection Act 2018, section 164A (inserted by the Data (Use and Access) Act 2025, section 103). Available at: https://www.legislation.gov.uk/ukpga/2018/12/section/164A and https://www.legislation.gov.uk/ukpga/2025/18/section/103 [Accessed 2 November 2026]. Quote: "providing a complaint form which can be completed electronically" and "acknowledge receipt of the complaint within the period of 30 days".
UK General Data Protection Regulation, Article 12A (inserted by the Data (Use and Access) Act 2025, section 76). Available at: https://www.legislation.gov.uk/ukpga/2025/18/section/76 [Accessed 2 November 2026]. Quote: "the period of one month beginning with the relevant time".
UK General Data Protection Regulation, Article 12(5). Available at: https://www.legislation.gov.uk/eur/2016/679/article/12 [Accessed 2 November 2026]. Quote: "shall be provided free of charge".
UK General Data Protection Regulation, Article 12(4). Available at: https://www.legislation.gov.uk/eur/2016/679/article/12 [Accessed 2 November 2026]. Quote: "making a complaint to the controller under section 164A of the 2018 Act".
UK General Data Protection Regulation, Article 12(6)(b). Available at: https://www.legislation.gov.uk/eur/2016/679/article/12 [Accessed 2 November 2026]. Quote: "delay dealing with the request until the identity is confirmed".
UK General Data Protection Regulation, Article 15(3). Available at: https://www.legislation.gov.uk/eur/2016/679/article/15 [Accessed 2 November 2026]. Quote: "may charge a reasonable fee based on administrative costs".
7. Version history
| Version | Date | Author | Reason for change | Presented to SLT | Signed off |
|---|---|---|---|---|---|
| v1.7 | 2 November 2026 | Edwin Luther | Rewritten in plain English for public readers. ICO complaint page and helpline 0303 123 1113 added (verified on the ICO page). Fee rule aligned with UK GDPR Articles 12(5) and 15(3). Time limits verified under UK GDPR Article 12A. Complaint-to-controller duty added (DPA 2018 s 164A). Sources list added. | — | n/a |
| v1.6 | 12 October 2026 | Edwin Luther | Placeholder postal address replaced with the registered office; B3 identity wording clarified. | — | — |
| v1.5 | 24 September 2026 | Edwin Luther | Review cycle set to a minimum of once every 12 months, approved by the Senior Leadership Team (SLT), with QA review by a Manchester AI Guild member who did not draft the document. | — | — |
| v1.4 | 24 September 2026 | Edwin Luther | Reporting and escalation route changed to report@manchesteraiguild.com; ownership allocated to Edwin Luther, Risk & Governance Director, with Trevor Roberts as secondary. | — | — |
| v1.3 | 20 September 2026 | Edwin Luther | Data Protection Officer role replaced by Data Protection Lead (to be appointed) and the dpo@ mailbox by report@manchesteraiguild.com, following #75. | — | — |
| v1.2 | 17 September 2026 | Edwin Luther | Independent critique applied: response owner named; secure-route example added. Undated ICO pages cited as n.d. Compliance lint (scripts/policy-tools.mjs) passed with 0 errors. | — | n/a |
| v1.1 | 17 September 2026 | Edwin Luther | MAIG standard applied: document control, defined terms, roles table, references, version history; Speaking up policy cross-referenced. Timings unchanged (A16). | — | n/a |
| v1.0 | 16 September 2026 | Edwin Luther | First website draft against ICO right-of-access guidance. | — | n/a |