What can I do if my data access request is ignored or refused?

If your Data Subject Access Request (DSAR) is ignored or refused, you can raise a formal complaint with the Information Commissioner's Office (ICO). ICO complaint readiness is a key step for data subjects facing such issues.

Can I ask a company to delete my personal data?

You may have the right to request the erasure of your personal data under Article 17 of the relevant data protection legislation. This is a specific right available to data subjects who wish to have their information deleted by an organisation.

What main data privacy issues are covered for data subjects?

The information covers several key areas for data subjects, including DSARs, the right to erasure, making ICO complaints, claiming damages for distress, automated decision-making, and issues related to direct marketing without consent.

Is direct marketing without consent a recognised data privacy issue?

The provided text notes that direct marketing without consent is a specific issue relevant to data subjects. It is listed alongside other rights and remedies, such as DSARs and erasure requests, that individuals may need to address.

All Situations

For Data Subjects

DSARs, erasure, ICO complaints, damages for distress, automated decision-making, and direct marketing.

Reviewed 2026-05-22

Common Problems

DSAR ignored or refused

Right to erasure (Article 17)

ICO complaint readiness

Data breach notification received

Direct marketing without consent

Your Rights

Your Data Privacy Rights

Your rights under UK GDPR — access your data, request deletion, object to marketing, and hold organisations accountable for misusing your personal information.

Letter Templates

Subject Access Request (DSAR)

UK GDPR Article 15 request for a copy of your personal data held by an organisation.

Right to Erasure Request (Article 17 UK GDPR)

Request to a data controller to erase your personal data under Article 17 of the UK GDPR.

Formal Complaint to the ICO

Letter accompanying an ICO complaint about a data controller's failure to comply with UK GDPR.

Legal Tools & Calculators

DSAR Deadline Calculator

Calculate the statutory response deadline for a Data Subject Access Request (DSAR) under UK GDPR Article 12(3) — one calendar month, extendable by two further months for complex or numerous requests.

Data breach 72-hour ICO notification deadline

Article 33 UK GDPR requires controller notification to ICO within 72 hours of awareness.

Frequently asked questions

What can I do if my data access request is ignored or refused?: If your Data Subject Access Request (DSAR) is ignored or refused, you can raise a formal complaint with the Information Commissioner's Office (ICO). ICO complaint readiness is a key step for data subjects facing such issues.
Can I ask a company to delete my personal data?: You may have the right to request the erasure of your personal data under Article 17 of the relevant data protection legislation. This is a specific right available to data subjects who wish to have their information deleted by an organisation.
What main data privacy issues are covered for data subjects?: The information covers several key areas for data subjects, including DSARs, the right to erasure, making ICO complaints, claiming damages for distress, automated decision-making, and issues related to direct marketing without consent.
Is direct marketing without consent a recognised data privacy issue?: The provided text notes that direct marketing without consent is a specific issue relevant to data subjects. It is listed alongside other rights and remedies, such as DSARs and erasure requests, that individuals may need to address.

When to Get Legal Advice

If the breach has caused you significant distress or financial harm, consider a civil claim under s.168 DPA 2018. Specialist data-protection solicitors are typically instructed for high-value or class-action claims.