GOTOSHARP sharp solutions smarter future
Google Translate

Personal Data & GDPR Rights

Introduction

The General Data Protection Regulation (GDPR) — retained in UK law as the UK GDPR after Brexit, alongside the Data Protection Act 2018 — gives you a set of rights over how organisations collect, store, and use your personal information. These rights are not theoretical. They are enforceable by law, and the regulator, the Information Commissioner’s Office (ICO), has the power to issue significant fines to organisations that break the rules. Understanding what you can ask for and how to ask for it puts you in a stronger position when dealing with companies, public bodies, or anyone else who holds data about you.

Your Rights Under UK GDPR

The legislation sets out eight core rights for individuals:

  1. The right to be informed — organisations must tell you what data they collect and why, usually in a privacy notice.
  2. The right of access — you can ask to see the personal data an organisation holds about you. This is a Subject Access Request (SAR).
  3. The right to rectification — if the data is inaccurate or incomplete, you can demand it be corrected.
  4. The right to erasure — the “right to be forgotten.” You can ask for your data to be deleted in certain circumstances, though this is not absolute.
  5. The right to restrict processing — you can limit how an organisation uses your data while a dispute is being resolved.
  6. The right to data portability — you can request your data in a machine-readable format and have it transferred to another service.
  7. The right to object — you can object to your data being used for direct marketing (this is an absolute right) or for purposes based on legitimate interests or public tasks.
  8. Rights relating to automated decision-making and profiling — you have protections against decisions made solely by automated means that have legal or significant effects on you.

Making a Subject Access Request

A Subject Access Request (SAR) is the most commonly used GDPR right. You can make one verbally or in writing to any organisation, and you do not need to use a specific form or mention the legislation by name. A simple email saying “please send me the personal data you hold about me” is legally sufficient.

The organisation must respond within one calendar month. They can extend this by two months if the request is complex or if you have made several requests. If they refuse, they must explain why and tell you about your right to complain to the ICO.

There is no charge for a SAR in most circumstances. An organisation can charge a “reasonable fee” only if the request is manifestly unfounded or excessive — for example, if you keep asking for the same data repeatedly — and even then, they must justify it.

Common Issues

One of the most frequent frustrations is that organisations drag their feet. The one-month clock starts when the organisation receives your request and has enough information to identify you. If they ask for ID and you do not provide it promptly, the clock stops until you do. It is a good idea to include whatever they need to identify you — account number, customer reference, or a copy of your passport or driving licence — with your initial request.

Another common issue is the belief that the right to erasure is absolute. It is not. An organisation can refuse to delete your data if it needs to keep it for legal reasons (such as tax records), for public health purposes, or in the exercise or defence of legal claims. What they must do is explain which exemption they are relying on.

People sometimes confuse GDPR with a right to have anything unflattering removed. That is not what the law says. The right to erasure does not override freedom of expression, journalistic purposes, or the legitimate need to maintain accurate records of events.

Complaints and Enforcement

If an organisation fails to respond to your request, or if you believe it has breached your data protection rights, your next step is the Information Commissioner’s Office. The ICO will expect you to have raised the matter with the organisation first and given it a reasonable time to respond. When you contact the ICO, provide a timeline of what happened, copies of your correspondence, and an explanation of what you want the ICO to do.

The ICO can order organisations to comply, issue reprimands, and impose fines. The maximum fine under UK GDPR is £17.5 million or 4% of annual worldwide turnover, whichever is higher. For public bodies, enforcement tends to involve practice recommendations and public censure rather than fines.

Practical Tips

  • Read privacy notices before you share your data. They are often long, but the key bits — what data they collect, why, and who they share it with — are usually near the top.
  • Opt out of direct marketing every time you see the option. Tick boxes for “do not send me marketing” should be clear and prominent; pre-ticked boxes do not count as valid consent under GDPR.
  • If you receive unwanted marketing emails, check for an unsubscribe link. Legitimate companies provide them. If there is no link, or if unsubscribing does not work, report it to the ICO.
  • Keep records. If you make a SAR, save the email and set a calendar reminder for the one-month deadline. If the response is incomplete, follow up in writing.
  • When a company suffers a data breach involving your information, they must tell you if the breach is likely to result in a high risk to your rights and freedoms. If they do not, report them.

Official Resources

Official Contacts

UK: Information Commissioner’s Office (ICO) — 0303 123 1113. Website: https://ico.org.uk. Email: casework@ico.org.uk

India: Data Protection Bill resources — https://www.meity.gov.in. CERT-In: 1800 11 4949. Email: incident@cert-in.org.in