Welsh translation. This page is translated from the canonical English version for general information. UK legal terms do not always translate exactly — check the English source for legal decisions and seek professional advice for important matters. The English page is authoritative.

For Data Subjects

DSARs, erasure, ICO complaints, damages for distress, automated decision-making, and direct marketing.

Reviewed 2026-05-22

Common Problems

DSAR ignored or refused

Right to erasure (Article 17)

ICO complaint readiness

Data breach notification received

Direct marketing without consent

Your Rights

Your Data Privacy Rights

Your rights under UK GDPR — access your data, request deletion, object to marketing, and hold organisations accountable for misusing your personal information.

Letter Templates

Subject Access Request (DSAR)

UK GDPR Article 15 request for a copy of your personal data held by an organisation.

Right to Erasure Request (Article 17 UK GDPR)

Request to a data controller to erase your personal data under Article 17 of the UK GDPR.

Formal Complaint to the ICO

Letter accompanying an ICO complaint about a data controller's failure to comply with UK GDPR.

Legal Tools & Calculators

DSAR Deadline Calculator

Calculate the statutory response deadline for a Data Subject Access Request (DSAR) under UK GDPR Article 12(3) — one calendar month, extendable by two further months for complex or numerous requests.

Data breach 72-hour ICO notification deadline

Article 33 UK GDPR requires controller notification to ICO within 72 hours of awareness.

When to Get Legal Advice

If the breach has caused you significant distress or financial harm, consider a civil claim under s.168 DPA 2018. Specialist data-protection solicitors are typically instructed for high-value or class-action claims.