Your Data Protection Rights
Everyone in the UK has enforceable rights over their personal data under the UK GDPR and the Data Protection Act 2018, both significantly amended by the Data (Use and Access) Act 2025. These rights apply to almost every organisation that holds information about you, from tech platforms to your GP surgery. Most requests are free and must normally be answered within one month.
Last updated: 2026-07-30
Your Rights
Right of Access (Subject Access Request)
You can obtain confirmation of whether an organisation is processing your personal data and, if so, a copy of that data plus information including the purposes, the categories of data, who it has been disclosed to and how long it will be kept. Since the 2025 reforms, the organisation must carry out a 'reasonable and proportionate search' for your data. A parallel access right applies to police and other law enforcement processing.
Right to a Free Answer Within One Month
Requests must be dealt with free of charge and answered before the end of the 'applicable time period' — one month from the relevant time. The organisation can extend by up to two further months only where requests are complex or numerous, and must notify you with reasons within the first month. A reasonable fee or refusal is allowed only for 'manifestly unfounded or excessive' requests, and the organisation bears the burden of demonstrating that.
Right to Rectification
You can require the organisation to correct inaccurate personal data about you 'without undue delay', and to complete incomplete data, including by adding a supplementary statement.
Right to Erasure ('Right to be Forgotten')
You can require erasure where a listed ground applies — for example the data is no longer necessary, you withdraw consent and there is no other legal ground, you have successfully objected, or the data was unlawfully processed. The 2025 Act added a ground covering data generated by investigated allegations made maliciously about you. Erasure does not apply where processing is necessary for exercising freedom of expression and information, or to meet legal obligations.
Right to Data Portability
Where processing is based on your consent or a contract and carried out by automated means, you can receive the data you provided 'in a structured, commonly used and machine-readable format' and transmit it to another provider — or have it sent directly between providers where technically feasible.
Right to Object, Including an Absolute Right for Direct Marketing
You can object to processing based on public-interest or legitimate-interest grounds, and the organisation must stop unless it demonstrates compelling legitimate grounds that override your interests. For direct marketing the right is absolute: once you object, your data 'shall no longer be processed for such purposes'.
Safeguards for Significant Automated Decisions
Where a significant decision about you — one with legal or similarly significant effects — is taken based solely on automated processing (no meaningful human involvement), the organisation must have safeguards letting you get information about the decision, make representations, obtain human intervention and contest the decision. These rules replaced the old Article 22 from 5 February 2026.
Right to Complain — to the Organisation and to the ICO
You now have a statutory right to complain directly to the organisation, and you can complain to the Information Commissioner if you consider the UK GDPR or the Data Protection Act has been infringed. The Commissioner must facilitate complaints (for example with an electronic form), respond appropriately and inform you of the outcome. You can also seek a judicial remedy through the courts.
Common Myths
You have to pay to see the data an organisation holds on you.
Subject access requests and the other data-subject rights must be provided free of charge. A reasonable fee is only allowed for extra copies or where a request is 'manifestly unfounded or excessive' — and the organisation must prove that (UK GDPR Article 12(5)).
Organisations can take as long as they like to respond.
The deadline is one month. It can be extended by up to two further months only for complex or numerous requests, and the organisation must tell you within the first month and give reasons (UK GDPR Article 12A).
The right to be forgotten means anything written about you must be deleted on demand.
Erasure only applies on specific grounds, and it gives way where processing is necessary for freedom of expression and information or for legal obligations (UK GDPR Article 17(3)).
Brexit ended GDPR rights in the UK, and computers can now decide everything about you.
The UK GDPR remains law, updated by the Data (Use and Access) Act 2025. Solely automated significant decisions are not banned, but you are entitled to safeguards: information, representations, human intervention and the ability to contest the decision (Articles 22A–22C).
What To Do
Make Your Request in Writing
Contact the organisation (its privacy team or Data Protection Officer), say clearly what you want — a copy of your data, a correction, erasure or an objection — and keep a dated copy of the request.
Diarise the One-Month Deadline
The organisation must act before the end of one month. If it extends for complexity, it must notify you with reasons within that first month — silence past the deadline is itself a breach.
Complain to the Organisation First
Use the organisation's own complaints route — since the 2025 reforms there is a statutory right to complain to the controller under s.164A of the Data Protection Act 2018.
Escalate to the ICO
If unresolved, complain to the Information Commissioner's Office (helpline 0303 123 1113). The ICO must respond to your complaint and inform you of the outcome.
Consider a Court Remedy
You can also seek a judicial remedy, including a court order under s.167 of the Data Protection Act 2018 requiring the organisation to comply. Get legal advice for compensation claims.
Key Legislation
- UK General Data Protection Regulation (UK GDPR)
- Data Protection Act 2018
- Data (Use and Access) Act 2025