# Regulatory Complaint Response Letter Template

**CONFIDENTIAL — LEGALLY PRIVILEGED**

---

**From:** Meridian Analytics Ltd
Data Protection Office
47 Canary Wharf Tower, London E14 5AB

**Date:** 14 March 2026

**To:** Information Commissioner's Office
Wycliffe House, Water Lane
Wilmslow, Cheshire SK9 5AF

**ICO Reference:** IC-284719-R3P2
**Our Reference:** REG-2026-0228

**Subject:** Response to Complaint — IC-284719-R3P2

---

Dear Case Officer,

Thank you for your letter dated 28 February 2026 regarding the complaint lodged by the data subject (reference IC-284719-R3P2). We welcome the opportunity to address the matters raised and provide our account of events.

## 1. Background

Meridian Analytics Ltd provides data analytics services to business clients. The complainant is a former subscriber who held an Enterprise account between June 2023 and January 2026. The complainant's account was closed on 15 January 2026 at the complainant's request.

## 2. Response to Allegations

### Allegation 1: Failure to respond to DSAR within 30 days

The complainant alleges that their Data Subject Access Request submitted on 10 December 2025 was not responded to within the statutory 30-day period.

**Our response:** We acknowledge that our response was delivered on 14 January 2026, which was 35 calendar days after receipt. We notified the complainant on 06 January 2026 (within the initial 30-day period) that an extension of 14 days was required due to the volume of data across multiple systems (the complainant's account spanned 4 distinct processing systems with 2,847 records). This extension was communicated in accordance with Article 12(3) UK GDPR.

**Evidence attached:** Copy of extension notification email dated 06 January 2026 (Appendix A), copy of DSAR response dated 14 January 2026 (Appendix B), DSAR processing log (Appendix C).

### Allegation 2: Incomplete data provided in DSAR response

The complainant alleges that support ticket correspondence was not included in the DSAR response.

**Our response:** Upon investigation, we identified that support ticket data stored in our Zendesk system was not included in the initial DSAR response due to an oversight in our data mapping documentation — the Zendesk integration was implemented in September 2025 and the DSAR data mapping had not been updated. We provided the missing support ticket data to the complainant on 25 January 2026 upon identifying the omission. We have since updated our DSAR data mapping documentation to include all current systems.

**Evidence attached:** Updated DSAR data mapping register (Appendix D), supplementary data response dated 25 January 2026 (Appendix E).

## 3. Remediation Steps

We have implemented the following corrective actions:

| Action | Status | Completion Date |
|--------|--------|-----------------|
| Updated DSAR data mapping to include Zendesk | Complete | 20 January 2026 |
| Implemented quarterly data mapping review process | Complete | 01 February 2026 |
| Conducted training for DSAR processing team on new system integrations | Complete | 15 February 2026 |
| Added automated system inventory check to DSAR processing workflow | In progress | Target: 31 March 2026 |

## 4. Cooperation

We remain fully committed to cooperating with the ICO and are happy to provide any additional information you may require. Please direct any further correspondence to our Data Protection Officer at dpo@meridiananalytics.co.uk or the address above.

Yours faithfully,

**Dr Sarah Chen**
Data Protection Officer
Meridian Analytics Ltd

---

**Appendices:**
A. Extension notification email (06 January 2026)
B. DSAR response (14 January 2026)
C. DSAR processing log
D. Updated DSAR data mapping register
E. Supplementary data response (25 January 2026)