# Online Privacy Complaint — Publicly Accessible Invoice
Date: 19 October 2026
Parties and reference: Complainant: Alice Ward, 5 Example Gardens, Cambridge. To privacy lead, Example Online Retail Ltd, 11 Commerce Example Court, Cambridge. Customer reference EXAMPLE-CUST-041; support ticket EXAMPLE-PRIV-1009. Reply: alice.ward@example.com.
## 1. Exposure discovered and earlier contact
On 8 October 2026 I found that the invoice link in my order email opened without signing in and displayed my full name, home delivery address, order description and purchase amount. It did not show full card details. I reported the link to support on 9 October; the 10 October acknowledgement supplied the ticket above but no containment confirmation. I could still open it on 12 October. The screenshot supplied through your secure channel redacts the private link; I have not published it or tested other customers' records.
## 2. Urgent containment and investigation
Please disable unauthorised access promptly, preserve relevant audit evidence, assess cached or indexed copies and tell me what practical steps protect my information. Preserve logs securely without keeping the public exposure live. Please investigate the likely exposure period, categories of recipients or access, cause and safeguards introduced. I am concerned about security and transparency under UK data-protection law, but do not assume that an accessible link proves every internet user actually viewed it. Please use a secure route for any evidence that contains my address.
## 3. Complaint handling under current rules
Please treat this as a complaint under section 164A of the Data Protection Act 2018, inserted by the Data (Use and Access) Act 2025 and applicable to complaints received from 19 June 2026. Please acknowledge within the applicable 30-day period, investigate appropriately, keep me informed and communicate the outcome without undue delay. That acknowledgement period is not a promise that every complaint must be finally resolved within 30 days. Please identify the responsible contact and distinguish any earlier support acknowledgement from a substantive answer.
## 4. Separate scoped access request and retention
Separately, I request a copy of my personal data concerning the exposed invoice and the handling of ticket EXAMPLE-PRIV-1009, including relevant access records insofar as they are my personal data, and information about purposes, recipients and retention. Please respond without undue delay and ordinarily within one calendar month, explaining any lawful extension or necessary identification or clarification rather than treating the complaint acknowledgement deadline as the access deadline. Third-party rights and lawful exemptions may require redaction. I seek removal of public access, not destruction of records you must lawfully retain for accounts or this investigation.
## 5. Breach assessment, remedy and escalation
Please assess whether notification to the ICO or affected individuals is legally required, recording reasons; I do not demand notification of every incident regardless of risk. Explain containment and prevention, correct any inaccurate account data and confirm a safe invoice-access method. I am not demanding an automatic compensation tariff, and the ICO does not award compensation. I may complain to the ICO if dissatisfied, normally allowing you an opportunity to address this first, and take separate advice about any court remedy. Signed Alice Ward, 19 October 2026. Please do not send a replacement publicly accessible invoice link.