In reply to MarkK.
As explained in the comment above, there are clear circumstances where the certified company is responsible for loss.
We will be publishing the privacy impact assessment soon. As Orvokki has explained in previous comments, this won't include issues related to fraud but we will be blogging shortly about what kind of fraud our standards prevent.
All certified companies are obliged to implement a complaints process, which is reviewed by GDS as part of their acceptance prior to going live. The dispute resolution function mentioned in the principles - which has previously been referred to as an Ombudsman - is handled by GDS. At this time we do not expect to need to recruit an individual to fulfil that function, but that decision will be reviewed regularly in response to service monitoring and user needs.
