Companies of a certain size are required to have data protection officers, some publish details of those on their privacy pages (though I'm not sure if that's r

Companies of a certain size are required to have data protection officers, some publish details of those on their privacy pages (though I'm not sure if that's required). That's how I actioned this instance. Otherwise an email to wherever. The threat of ICO involvement is enough to motivate people to resolve errors quickly, because the ICO (in the UK) does take regular action at all levels (not just the big fish). https://ico.org.uk/action-weve-taken/enforcement/ https://ico.org.uk/action-weve-taken/enforcement/