Personal Data & GDPR Rights

Personal Data & GDPR Rights

1. UK GDPR Rights Overview

After Brexit, the UK adopted its own version of GDPR — the UK GDPR — mirroring the EU GDPR in nearly all respects. Together with the Data Protection Act 2018, they give individuals eight core rights:

• Right to be informed: Organisations must tell you what data they collect, why, how long they keep it, and who they share it with — usually through a privacy notice.
• Right of access: You can request a copy of personal data held about you — a Subject Access Request (SAR). See Section 2.
• Right to rectification: If data about you is inaccurate or incomplete, you can demand correction. Organisations must respond within 1 month.
• Right to erasure (“right to be forgotten”): In certain circumstances, you can request your data be deleted. See Section 6.
• Right to restrict processing: You can limit how an organisation uses your data — for example, while a dispute about accuracy is resolved.
• Right to data portability: You can obtain and reuse your data across different services — e.g., moving banking history to a new provider.
• Right to object: You have an absolute right to object to direct marketing. You can also object to processing based on legitimate interests or public task.
• Rights relating to automated decision-making: You have the right not to be subject to decisions based solely on automated processing (including profiling) that produce legal or significant effects — covering algorithmic decision-making in credit scoring, recruitment, and insurance.

These rights are not absolute — subject to exemptions (legal privilege, crime prevention, national security). However, organisations must clearly justify any exemption they rely on when refusing a request.

2. Subject Access Requests (SAR)

A Subject Access Request lets you see what personal data an organisation holds about you — one of the most powerful transparency tools:

• What you can request: Confirmation that your data is being processed, a copy of your personal data, and supplementary information (purposes of processing, categories of data, recipients, retention periods, your rights, source of data, whether automated decision-making is used).
• How to make a SAR: Verbally or in writing — email is best as it creates a record. No required form and no fee (except for manifestly unfounded or excessive requests). Address it to the organisation’s Data Protection Officer (DPO) — all public authorities and most larger companies must have one.
• What to include: Full name, account/customer reference numbers, a clear statement that you are making a SAR under UK GDPR, specific details of what data you are requesting (narrowing scope helps — e.g., “all emails about my complaint between January and March 2025”), and proof of identity if needed.
• Timeline: The organisation must respond within 1 calendar month. This can be extended by up to 2 months if the request is complex — they must inform you within the first month.
• What you should receive: A copy of your data in a commonly used, machine-readable format (usually PDF). The data should be intelligible — any codes or abbreviations must be explained. Third-party personal data may be redacted.
• If they refuse: Send a follow-up after 30 days. If still no response, complain to the ICO (see Section 7). You can also apply to a court for an order — though the ICO route is faster and free.

3. Data Breach Reporting Guide

A personal data breach is a security incident leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data — covering cyber-attacks, lost devices, emails sent to wrong recipients, and staff accessing records without legitimate reason:

• Organisation’s duty: Report breaches likely to risk your rights and freedoms to the ICO within 72 hours. If the risk is high (financial fraud, identity theft, sensitive health data), they must also inform you without undue delay.
• If you are affected: The organisation should tell you what data was compromised, the likely consequences, and what they are doing. They should give practical advice — changing passwords, contacting your bank, registering with fraud prevention services, or credit monitoring (which they may pay for).
• If they fail to notify you: Complain to the ICO. The ICO can fine up to £17.5 million or 4% of annual worldwide turnover (whichever is higher) for serious GDPR infringements.
• Preventive steps: Use unique passwords for every service (a password manager makes this easy). Enable two-factor authentication (2FA) on email, banking, and social media. Be alert to phishing emails referencing the breach — scammers often piggyback on real breaches. Monitor your bank statements and get a free statutory credit report from Experian, Equifax, and TransUnion.
• Breach compensation: If you suffer material damage (financial loss) or non-material damage (distress, anxiety) from a data breach, you may be entitled to compensation. Claim directly from the organisation or through the courts.

4. Opt-Out of Data Sharing

Organisations share and sell personal data more than most people realise. You have the right to opt out:

• Marketing opt-out (absolute right): Under Article 21 of UK GDPR, you have an absolute right to object to direct marketing. The organisation must stop immediately and confirm in writing. Use unsubscribe links in emails, text “STOP” to SMS marketing, or write to the DPO.
• Open electoral register: When you register to vote, you are automatically on the full register. Opt out of the open register — the version anyone can buy for any purpose. Tick the opt-out box when registering. This does not affect your right to vote or credit score.
• Royal Mail Door-to-Door opt-out: Stop unaddressed marketing mail at royalmail.com.
• Mailing Preference Service (MPS): mpsonline.org.uk — reduces addressed direct mail. Free for individuals. May take up to 4 months to take full effect.
• Telephone Preference Service (TPS): tpsonline.org.uk — reduces unsolicited sales and marketing calls. Legal requirement for UK-based organisations to respect TPS registration. Legitimate UK telemarketing should stop within 28 days.
• Online behavioural advertising: Visit youronlinechoices.com/uk to opt out of interest-based advertising from hundreds of companies. Note: clearing browser cookies resets these opt-outs.
• Credit reference agency opt-outs: You cannot opt out of credit reference agencies entirely, but you can opt out of your data being used for marketing pre-screening (“pre-approved” credit offers). Contact Experian, Equifax, and TransUnion directly.

5. Cookie Consent & Tracking

The Privacy and Electronic Communications Regulations (PECR) work alongside UK GDPR to regulate cookies and similar tracking technologies:

• What the law requires: Websites must tell you what cookies they use and why, and obtain consent before setting non-essential cookies. Consent must be freely given, specific, informed, and unambiguous — pre-ticked boxes and “by continuing to browse you consent” do not comply. Rejecting must be as easy as accepting.
• Essential vs. non-essential: Essential cookies (session, shopping basket, security) do not require consent. Non-essential cookies (Google Analytics, Facebook Pixel, ad tracking) require explicit opt-in before being set.
• Your practical choices: Use the cookie banner to reject all non-essential cookies — it should be a one-click option (if not, the website is non-compliant — report to the ICO). Browser-level controls: block third-party cookies, enable Enhanced Tracking Protection in Firefox (Strict mode), or “Prevent cross-site tracking” in Safari. Consider privacy-focused browsers (Brave, Firefox) or tracker-blocking extensions (uBlock Origin, Privacy Badger).
• Complaints: If a website does not provide a clear reject option, sets cookies before consent, or makes rejecting harder than accepting, report them to the ICO at ico.org.uk/make-a-complaint.

6. Right to Be Forgotten

The “right to erasure” — popularly known as the “right to be forgotten” — allows you to request deletion of your personal data in specific circumstances:

• When it applies: Data no longer necessary for its purpose; you withdraw consent and no other legal basis exists; you object to processing with no overriding legitimate grounds; data unlawfully processed; data must be erased to comply with a legal obligation; data collected from a child for online services.
• When it does NOT apply: Data needed for freedom of expression; compliance with a legal obligation; public health purposes; archiving, research, or statistics where erasure would impair processing; or establishment, exercise, or defence of legal claims.
• How to request: Write to the DPO specifying you are exercising your right under Article 17 of UK GDPR, what data you want deleted, and which ground applies. Response required within 1 calendar month.
• Search engine delisting: Even after deletion, data may remain in search results. Request delisting from each search engine — Google’s form is at Google legal removal request. Search engines balance privacy rights against public interest — they may refuse if the information serves the public interest.
• Social media: The right to erasure applies to both data you provided and data others posted about you. For content others have posted, use the platform’s reporting mechanism first — if that fails, a formal erasure request under UK GDPR is the next step.

7. Data Protection Complaints (ICO)

The Information Commissioner’s Office (ICO) is the UK’s independent regulator for data protection and freedom of information:

• When to complain: An organisation has ignored or refused your SAR, failed to correct inaccurate data, continued direct marketing after opt-out, failed to notify of a breach, or processed data unlawfully. Raise the issue with the organisation first — the ICO expects this step. If no satisfactory response within 1 month, escalate to the ICO.
• How to complain: Visit ico.org.uk/make-a-complaint or call 0303 123 1113. Provide the organisation’s name, nature of complaint, copies of correspondence, and your desired outcome. The ICO cannot award compensation — for that, go to court — but can order compliance and issue fines up to £17.5 million or 4% of global turnover.
• ICO live chat: Available on their website for quick questions — often faster than calling during peak periods.
• Nuisance calls and spam texts: Report to the ICO at ico.org.uk/make-a-complaint/nuisance-calls-and-messages. The ICO can fine companies up to £500,000 under PECR. Also forward spam texts to 7726 (free — spells SPAM on a phone keypad).

8. Employer Data Protection Duties

Employers process some of the most sensitive personal data about individuals. Both employers and employees should understand the rules:

• Employee rights: You have the same UK GDPR rights over employment data as any other personal data. You cannot be penalised or dismissed for making a SAR — this would be automatically unfair dismissal and victimisation under the Data Protection Act.
• Employer obligations: Employers must have a lawful basis for processing (usually “contract” or “legal obligation”), provide a privacy notice, limit data collection to what is necessary, implement security measures (password protection, encryption, access controls), and train staff on data protection.
• Monitoring at work: Employers can monitor workplace communications, but must have a lawful basis, inform employees through a clear policy, and only monitor proportionately. Covert monitoring (without employees’ knowledge) is lawful only in exceptional circumstances — e.g., suspected criminal activity where informing employees would prejudice investigation.
• Data retention: Payroll and tax records should be kept for 6 years (HMRC compliance). HR records (contracts, performance reviews, disciplinaries) for up to 6 years after employment ends. Recruitment records for unsuccessful candidates should be deleted after 6-12 months unless the candidate consents to being kept on file.
• References: References must be fair, accurate, and not misleading. Former employees can make a SAR to see what reference was given — though references given in confidence may be exempt from disclosure if the employer demonstrates confidentiality is necessary.

---

GOTOSHARP Information Hub resource article. Last updated: June 2026.