
Rachel Rigg has written a complaints procedure for organisations that apparently enjoy leaving an audit trail behind them.
Her Horsfield Menzies article, “NEW RIGHT TO COMPLAIN GOES LIVE”, explains the data-protection complaints regime brought fully into force in June 2026. Organisations handling personal data now need a clear route for complaints, an acknowledgement within 30 days and an investigation and response without undue delay. Rigg then adds the practical machinery: somebody should own the process, evidence should be gathered and considered, the complainant should be kept informed, investigatory steps and outcomes should be logged, and the eventual response should contain a reasoned explanation together with any remedial action or improvements.
It is almost offensively competent advice. You could run an actual complaints function from it without needing a consultant, a motivational breakfast seminar or some twat with a lanyard explaining what the word “accountability” means.
Unfortunately for Horsfield Menzies, I once sent a complaint involving disability-related medical information and the firm’s own conduct directly to the people at the top. That makes Rachel’s lovely little checklist considerably more entertaining.
The Complaints Factory Gets An Instruction Manual
There is no need to play cheap games with chronology. My complaint was made in March 2025, while the new statutory complaints duty came later. Nobody at TCAP is pretending legislation commencing in 2026 travelled backwards through time, landed in Angus Menzies’ inbox and started waving section numbers at him.
The juxtaposition is institutional, and it is nastier because of that. Horsfield Menzies now tells organisations what a serious data complaint process should look like because the firm plainly understands why each component matters. Someone needs responsibility for the complaint rather than letting it float between inboxes. Evidence needs examining rather than merely admiring from across the room. Meanwhile, the complainant needs updates because unexplained silence turns uncertainty into suspicion. Most importantly, an organisation should eventually explain what it concluded and why.
Rigg compares the process to an internal appeal because it gives the organisation a chance to “rectify problems, or set the record straight” before the issue reaches the regulator. That is not bureaucratic decoration. It is an escape hatch. If something went wrong, fix the bastard. If nothing went wrong, explain the evidence, close the issue properly and send everybody home before the dispute grows teeth.
Horsfield Menzies understands that mechanism beautifully now.
I know because I tried the earlier, apparently less fashionable version.
The Complaint Had Already Found The Fucking Building
On 23 March 2025, I sent a detailed complaint about Horsfield Menzies Senior Associate Sam Butler directly to Angus Menzies, Simon Horsfield and Daniel Rubin. It carried the Tribunal case number and raised what I regarded as serious issues involving disability-related medical information, contact involving my GP or medical centre, disputed statements during the litigation, aggressive costs pressure and correspondence I considered obstructive.
The following day I asked for something breathtakingly exotic: acknowledge the complaint, tell me whether anybody intended to investigate it and indicate when I could expect an outcome.
Nobody needed specialist training to recognise what had arrived. This was not a cryptic Teams message saying “not happy about that data thing btw” sent to Gary in Facilities. Instead, it was a direct written complaint addressed to senior lawyers by name, setting out allegations and requesting action.
Rigg’s article now warns employers that complaints may arrive “to anyone in any format” and staff should be trained to recognise them. Sensible advice. Somewhere, a hypothetical Horsfield Menzies client is therefore being told to make sure Janet in Payroll understands that an irritated email might actually trigger a formal data complaint.
Mine had skipped Janet and landed with Angus Menzies, Simon Horsfield and Daniel Rubin. A Labrador with a basic grasp of Outlook could have identified the fucking thing.
Reasoned Explanation Not Included
The most awkward phrase in Rigg’s checklist is “reasoned explanation”.
Not we disagree. Not our position remains unchanged. Not the legal-services equivalent of somebody lowering the shutter while avoiding eye contact.
A reasoned explanation contains some working. Here is what you alleged. Here is what we examined. This is what we established. Finally, this is why the allegation succeeds or fails and what, if anything, we intend to do about it.
That kind of answer benefits everybody. The complainant receives something capable of being understood and challenged, while the person accused does not remain permanently suspended inside an unresolved allegation. Management gets an actual record rather than folklore passed between partners over coffee. Better still, if a regulator appears later, the organisation can demonstrate that the complaint entered a process rather than a fucking wormhole.
Nothing resembling that sort of communicated investigation outcome reached me. No substantive findings arrived addressing the medical-information allegations, while nobody communicated an investigative scope, identified an independent investigator or explained what evidence had been considered. Equally, no remedial action was set out because no reasoned outcome of that kind ever came back through the door.
Perhaps Horsfield Menzies conducted an invisible investigation worthy of the Warren Commission. Maybe there is a magnificent internal file somewhere with interviews, chronology, findings, annotations and tasteful little tabs.
Lovely.
The complainant never saw it.
Evidence Gathering Apparently Has A Direction
Rigg also recommends gathering and considering evidence, which creates another enjoyable problem because Horsfield Menzies has never appeared institutionally frightened of evidence.
When one of my medical appointments mattered to a postponement dispute, the firm contacted the medical centre and obtained information about alternative appointment availability. That information then became useful to the argument being advanced against postponement. A factual uncertainty existed, somebody made the enquiry, an answer came back and the answer was deployed.
That is curiosity with decent shoes on.
Later, when my conduct became central to Cepac’s strike-out application, the appetite for evidence became positively industrial. Communications were collected alongside blog posts and X material, while previous litigation entered the picture too. Eventually, the main bundle reached 1,657 pages excluding the index, and dedicated conduct material turned my online and written output into something approaching a fucking geological survey.
Horsfield Menzies could locate evidence, preserve evidence, organise evidence and turn evidence into argument. There was never any indication that the firm had misplaced its magnifying glass.
By contrast, what I did not receive after complaining about Horsfield Menzies itself was a comparable visible process pointed inwards.
That is the distinction. The question is not whether these people know how to investigate. They very obviously fucking do.
The question is where the curiosity goes when the subject lives inside the building.
Rachel Even Brought A Logbook
Rigg recommends maintaining a record of applicable timescales, investigative steps and outcomes. It sounds dull because administrative accountability always sounds dull until somebody needs to establish what actually happened six months later.
Then the boring spreadsheet becomes a witness.
Apply that structure to my complaint and the whole thing becomes very simple. Angus Menzies, Simon Horsfield and Daniel Rubin received it. Who took ownership? Which material did Horsfield Menzies examine? Was Butler asked for an account? Did anybody review the medical-centre contact? What did the firm conclude about the disability-related information I complained about, and was anything changed, rejected or corrected?
These are not some hostile blogger’s exotic demands for ritual humiliation. They are the anatomy of the complaints process Rachel Rigg now recommends to clients.
TCAP did not invent the clipboard.
Rachel turned up carrying the bloody thing.
Set The Record Straight, Then
Rigg’s comparison with an internal appeal contains perhaps the most useful phrase in the article. A complaint process gives an organisation the chance to “rectify problems, or set the record straight”.
Exactly.
There is a persistent corporate fantasy that investigating a complaint somehow concedes the allegation. It does not. A proper investigation may conclude that the complainant misunderstood everything, the employee acted entirely properly and the organisation has nothing whatsoever to apologise for.
That would still be useful.
Horsfield Menzies could, for example, have explained why it considered the medical-centre contact proper. If Butler’s handling of disability-related information was entirely legitimate, the firm could have identified the basis. Allegations concerning statements made during proceedings could have been dismantled if the underlying evidence showed they were bollocks, while ordinary robust litigation conduct could have been defended as such if that was the conclusion.
Set the fucking record straight.
That was the opportunity.
Instead, the complaint survived because nothing reasoned reached me capable of killing it. Consequently, it travelled into regulatory complaints, litigation history and eventually TCAP. It became Category Fucking Zero, Blog vs Behaviour and a permanent little search-engine parasite attached to Horsfield Menzies every time somebody inside the firm publishes another article explaining how everybody else should handle complaints.
The quiet resolution route existed.
The record was waiting to be straightened.
Instead, it acquired SEO.
Anyone, Any Format, Except Apparently That One
There is excellent black comedy in Rigg warning that complaints can arrive “to anyone in any format”.
Imagine the training. Staff receive a carefully designed presentation explaining that a complaint might not arrive with FORMAL DATA PROTECTION COMPLAINT written across the top in ceremonial fucking calligraphy. It could appear in an email, arise through another process or land with somebody in HR. Consequently, managers need enough awareness to recognise the substance rather than obsess over the label.
All excellent practice.
My complaint had already eliminated that difficulty. Nobody needed to infer anything from tone, decode a conversation or wonder whether the person was merely venting. I addressed senior figures directly, described the alleged conduct and asked for investigation.
The patient walked into casualty carrying the fucking X-ray.
Recognition was never the problem.
What happened after recognition is the problem.
The Right To Complain Becomes A Product
Rigg works in exactly the area where this gets commercially interesting. Employment disputes and data rights frequently overlap. A DSAR can sit beside litigation, while a data complaint can become part of a grievance and concerns about personal information may also raise whistleblowing or regulatory issues. The neat administrative boxes organisations draw on flowcharts have a habit of turning into spaghetti when actual human beings start fighting.
Rigg understands that and tells employers to coordinate their processes properly. Complaint handlers should recognise when another procedure needs engaging and make sure issues do not disappear into the cracks between data protection, grievance and whistleblowing.
Again, sensible.
My complaint involved alleged misuse of medical information inside active Employment Tribunal litigation and raised concerns about the conduct of the solicitors handling that litigation. If ever there were a complaint likely to sit across multiple accountability systems, that was the bastard.
It also went directly to three senior lawyers.
The signposting problem had therefore solved itself before Horsfield Menzies needed to print a flowchart.
Category Zero Gets An Administrative Upgrade
TCAP has already written about Category Zero, the imaginary investigations tier which appears when the allegation points towards Horsfield Menzies rather than one of its paying clients.
The joke became possible because the firm later launched a Workplace Investigations Unit offering clients an impressive architecture: triage, evidence review, interviews, findings, recommendations, sensitivity and quality assurance. All the grown-up procedural furniture you would expect from people selling investigations professionally.
My complaint about Butler had gone to the firm’s senior figures long before that shiny product arrived. No comparable architecture was ever communicated back to me.
Rachel Rigg has now improved Category Zero further by supplying the administrative manual. Gather the evidence, keep the complainant informed, provide a reasoned explanation, record investigative steps and outcomes, then identify remedial measures or improvements.
Fucking marvellous.
At this rate Horsfield Menzies is going to reconstruct the complaint process I never saw one blog post at a time. Laura McLellan can supply the investigator, Simon Horsfield can explain why organisations should take challenge seriously, Rachel can bring the logbook and Sam Butler can write about stewardship of sensitive data. Meanwhile, Daniel Rubin can give us the culture lecture and Fungus can explain which bastard is attributable for whatever eventually crawls out of the machinery.
TCAP barely needs to commission articles anymore.
Horsfield Menzies keeps writing the prosecution bundle itself.
The New Law Is Not The Old Excuse
Accuracy makes the hit stronger, so the chronology deserves stating plainly. The new statutory complaints regime did not govern my March 2025 complaint. It came later.
Good.
That removes the easiest lawyerly escape route before anybody reaches for it.
The argument is not that Horsfield Menzies breached Rachel Rigg’s future checklist in 2025. Rather, the point is that the firm now recommends evidence gathering, accountable ownership, communication, recorded investigative steps, reasoned outcomes and remedial action because those are obviously sensible features of responsible complaint handling.
The new law did not invent the intellectual value of explaining what the fuck you did with a complaint. It simply made structured handling of data complaints a legal requirement.
Accordingly, that modern guidance illuminates the older behaviour without rewriting the law which applied at the time. Horsfield Menzies received a direct complaint involving sensitive medical information and one of its own solicitors, and the people at the top knew about it.
What never reached the complainant was the sort of accountable anatomy the firm now tells everybody else to build.
No time machine required.
Just eyesight.
The Quiet Version Was The Cheap Version
Institutions rarely understand how valuable a private complaint is until they squander it.
A private complaint is cheap. It may be unpleasant, awkward or professionally irritating, but nobody has indexed it yet. Google does not care, there are no permanent category pages and no black-comedy callbacks are waiting for the next employee to publish something exquisitely inconvenient.
It is an email.
Deal with the bloody thing.
Horsfield Menzies had that version in March 2025. The firm could have investigated, explained and closed the file. Even a complete rejection with proper reasons might have ended at least part of the dispute because there would have been something concrete to assess rather than a vacuum.
Instead, the unresolved complaint became part of what followed. It entered regulatory correspondence, litigation history and TCAP, where every fresh Horsfield Menzies article about investigations, complaints, data, fairness or accountability now arrives carrying its own potential punchline.
Rachel Rigg says a complaint process offers organisations a chance to fix problems or set the record straight before matters escalate.
Yes.
That was the cheap fucking version.
It was sitting in the inbox.
Reasoned Explanation Not Included
The current regime now requires organisations to make data complaints possible, acknowledge them, investigate appropriately and communicate outcomes. Horsfield Menzies supplements that baseline with its own useful guidance about gathering evidence, documenting the process, identifying remedial steps and providing a reasoned explanation.
That is a sound system.
It is also one hell of a mirror.
My complaint involved the firm’s Senior Associate, disability-related medical information and contact involving my medical centre. It went directly to Angus Menzies, Simon Horsfield and Daniel Rubin, after which I followed up and asked whether anybody intended to investigate it.
No reasoned investigation outcome reached me.
Later, Horsfield Menzies launched a professional investigations service. Now Rachel Rigg is publishing the anatomy of effective data-complaint handling. At some point, therefore, the recurring joke writes itself.
The firm keeps publishing increasingly detailed instructions for how Horsfield Menzies could have dealt with Horsfield Menzies.
Rachel called her article “NEW RIGHT TO COMPLAIN GOES LIVE.”
Fine.
TCAP had already discovered the right to complain.
What appeared to be missing was the other half of the transaction.
REASONED EXPLANATION NOT INCLUDED.
Lee Thompson – Founder, The Cummins Accountability Project
Sources
- Horsfield Menzies – New Right To Complain Goes Live
- ICO – New Data Protection Complaints Law Now In Force
- Data (Use and Access) Act 2025 – Section 103 / New Section 164A
- ICO – What Do We Do When We Receive A Complaint?
- Horsfield Menzies – Rachel Rigg
- TCAP – Angus Menzies And Simon Horsfield Got The Sam Butler Complaint : Welcome To Category Fucking Zero
- TCAP – Horsfield Menzies Workplace Investigations : Blog vs Behaviour
- TCAP – Simon Horsfield : The Carpet Has A Fucking Lump In It
