Individual rights under GDPR: a complete guide to data subject rights

A practical guide to the eight individual rights under UK GDPR — the right to be informed, the right of access, rectification, erasure, restriction, portability, objection, and rights related to automated decision-making — including how the DUAA 2025 changed the rules.

UK GDPR gives individuals — described as “data subjects” in the regulation — eight specific rights over the personal data that organisations hold about them. These rights are the practical mechanism by which the data protection principles are made real. They are also the most common interface between an organisation and the people whose data it processes.

This guide covers each of the eight rights, how to handle requests in practice, and the changes brought in by the Data (Use and Access) Act 2025 — including a new statutory right to complain directly to controllers.

The 8 rights at a glance

The eight rights under UK GDPR — overview grid

The eight rights under UK GDPR are:

The right to be informed — Articles 13 and 14.
The right of access — Article 15. The basis for Subject Access Requests (SARs or DSARs).
The right to rectification — Article 16.
The right to erasure, often called the “right to be forgotten” — Article 17.
The right to restrict processing — Article 18.
The right to data portability — Article 20.
The right to object — Article 21. Includes an absolute right to opt out of direct marketing.
Rights related to automated decision-making and profiling — Articles 22A to 22D, as rewritten by the DUAA.

Where Article 19 applies, tell recipients about rectification, erasure or restriction unless this is impossible or involves disproportionate effort. Tell the individual about those recipients if they ask.

The rights are not absolute. Most are qualified, with exemptions set out in UK GDPR itself or in Schedule 2 of the Data Protection Act 2018. The detail of what applies depends on the right and the context.

1. The right to be informed

Articles 13 and 14 give individuals the right to know what is being done with their personal data. The mechanism is the privacy notice.

The relevant rights, the right to withdraw consent where used, the right to complain to the ICO, and information about qualifying significant solely automated decision-making, where applicable.

For information collected directly, explain any statutory or contractual requirement to provide it and the consequences of not doing so. For information from another source, explain the categories and source, including whether it was publicly accessible, as Article 14 requires.

Give Article 13 information when collecting data directly. For Article 14, provide it within a reasonable period and normally within one month, or by the first communication or disclosure if earlier, unless an applicable exemption applies.

For more on what the privacy notice must contain and how to structure it, see our privacy notices guide.

2. The right of access (DSAR / SAR)

Article 15 gives individuals the right to obtain a copy of the personal data a controller holds about them, along with supplementary information about how the data is being processed.

Subject access requests (SARs, sometimes DSARs) are the most frequent way the right of access is exercised. A request:

Can be verbal or in writing, including via social media.
Can be submitted to any part of the organisation, not just a dedicated address.
Does not have to use the phrase “subject access request” — it just needs to be clear that the individual is asking for their own data.
Can be made by a third party with the right to act on the individual’s behalf (a solicitor, family member, or representative).

The default response deadline is one calendar month from receipt. This can be extended by up to two further months for complex or numerous requests, with the controller required to explain the delay within the original month.

The Data (Use and Access) Act 2025 codified two practical concepts that had previously been ICO guidance only:

The DUAA permits a pause while waiting for clarification reasonably required to identify the information or processing requested. Do not use clarification as a routine delay. Separate rules cover necessary identity information and any permitted fee.
Reasonable and proportionate search — the controller is required to conduct a reasonable and proportionate search, but is not required to search every possible location regardless of cost or effort.

A few specific points often missed:

The right concerns personal information and supplementary details, rather than an automatic right to every original document. Copies of documents or extracts may nevertheless be necessary to provide an intelligible and complete response.
Consider the rights of other people whose information appears in a response. Disclosure may be possible with their consent or where reasonable without it. Assess the circumstances and relevant confidentiality duties, and redact where needed; third-party information is not an automatic reason to refuse the entire request.
The first copy is free. A “reasonable fee based on administrative costs” can be charged for additional copies, or for requests that are manifestly unfounded or excessive.
Apply exemptions only where their legal conditions are met and document the reasoning. The Data Protection Act contains several schedules of exemptions; a general label such as confidentiality or legal proceedings does not itself justify refusal.

3. The right to rectification

Article 16 gives individuals the right to have inaccurate personal data corrected, and to have incomplete data completed.

The right is most straightforward where the data is factual — a name spelled wrong, an address that has changed, a date of birth that is incorrect. Controllers should correct without delay.

An opinion is not necessarily inaccurate because someone disagrees with it. Distinguish opinions from facts, identify whose view is recorded, and consider recording the challenge and correcting any inaccurate underlying facts.

Where rectification applies, Article 19 requires the controller to notify each recipient of the personal data of the change — unless this proves impossible or involves disproportionate effort.

4. The right to erasure (“right to be forgotten”)

Article 17 gives individuals the right to have personal data erased in specific circumstances. The right is not absolute; it applies where:

The data is no longer necessary for the purposes for which it was collected.
The individual withdraws consent, where consent was the lawful basis, and no other basis applies.
The individual objects under Article 21 and there are no overriding legitimate grounds.
The data has been unlawfully processed.
Erasure is required to comply with a legal obligation.
The data was collected from a child in connection with information society services.

The right does not apply where the controller needs the data to:

Exercise the right of freedom of expression and information.
Comply with a legal obligation (so customer tax records cannot be erased while the HMRC retention period still applies).
Carry out a task in the public interest.
Use the data for public health reasons in line with Article 9.
Carry out protected archiving, research or statistical processing where erasure would be likely to prevent or seriously impair its objectives and the required safeguards are met.
Establish, exercise, or defend legal claims.

The misconception that the right to erasure is absolute — that anyone can demand deletion of any data at any time — is one of the most common in this area. It is not. It applies in specific circumstances, with explicit exemptions.

Where a controller has made information public and must erase it, Article 17 requires reasonable steps to inform other controllers processing it of the erasure request, taking account of available technology and implementation cost. Article 19 separately deals with notifying recipients, subject to its exceptions.

5. The right to restrict processing

Article 18 gives individuals the right to restrict the processing of their personal data in specific situations:

While the accuracy of contested data is being verified.
Where processing is unlawful but the individual opposes erasure and requests restriction instead.
Where the controller no longer needs the data but the individual needs it for legal claims.
Where the individual has objected under Article 21, pending verification of overriding grounds.

Restricted information may generally be stored, but further processing requires a permitted ground, such as consent, legal claims, protecting another person's rights or an important public interest. Inform the individual before lifting a restriction.

Restriction can be relevant while a controller checks accuracy or considers an objection. It allows the information to be retained while limiting further use under the applicable conditions.

6. The right to data portability

Article 20 gives individuals the right to receive the personal data they have provided to a controller in a structured, commonly used, machine-readable format — and, where technically feasible, to have the data transmitted directly to another controller.

The right applies only where:

The lawful basis for processing is consent or contract, and
The processing is carried out by automated means.

Portability covers qualifying information the person provided, including some information observed from their use of a service. It does not normally include a controller's inferred or derived assessments.

Common examples: moving banking transaction history to a new provider under Open Banking, transferring contact lists between email platforms, exporting fitness tracking data from one app to another.

7. The right to object

Article 21 gives individuals the right to object to processing in two main situations:

The right to object applies to processing based on public task, legitimate interests or recognised legitimate interest, including relevant profiling. It also applies to direct marketing and, subject to the legal conditions, research and statistics.
Direct marketing. This is an absolute right. Once the individual objects to processing for direct marketing, the controller must stop, no balancing test applies, and there are no exemptions.

An objection to direct marketing is absolute: stop using the person's information for that purpose. Make this right clear and easy to exercise. Electronic marketing must also meet PECR's channel-specific rules, including applicable opt-out requirements.

A subtler application: objection to processing for scientific or historical research is also available, but qualified by public-interest exceptions.

8. Rights related to automated decision-making

This is the area most reshaped by the Data (Use and Access) Act 2025. The old Article 22 of the UK GDPR has been repealed and replaced by Articles 22A to 22D, with materially different rules.

Under the new framework:

Under the amended UK GDPR, significant solely automated decisions may use an appropriate lawful basis other than recognised legitimate interest. Decisions involving special category data remain restricted by Article 22B, and Article 22C requires safeguards such as information, representations, human intervention and a way to contest the decision.
The controller must implement safeguards, including:
- Providing the individual with information about the decision.
- Enabling the individual to make representations about it.
- Enabling the individual to obtain human intervention.
- Enabling the individual to contest the decision.

This is a material difference between the amended UK rules and EU GDPR Article 22. An organisation subject to both regimes must assess each one separately.

Assess the current Articles 22A–22D and ICO guidance when using automated decisions. Meaningful human involvement, the significance of the decision, lawful basis and any special category information all affect the obligations.

How to handle a rights request

The basic process for any incoming rights request:

Recognise it as a request. A rights request doesn’t have to use formal language — an email asking “what information do you have on me?” is a SAR.
Distinguish a rights request from a data protection complaint. Rights requests have their own statutory response deadlines. Complaints received from 19 June 2026 must be acknowledged within 30 days and answered without undue delay under the new complaints requirements.
Ask for extra identity information only where there are reasonable doubts and the request is proportionate. Where necessary, the response period begins when that information is received. Clarification reasonably needed for a subject access search can pause the deadline under the separate clarification rules.
Conduct the search. A reasonable and proportionate search, not an exhaustive search of every possible location.
Use an exemption or a manifestly unfounded or excessive refusal only where its specific conditions are met. Keep the reasons and tell the person about available complaint and court remedies where required.
Respond without undue delay and normally within one calendar month. The law permits extensions for complexity or the number of requests, and specific adjustments for necessary identity information, clarification and permitted fees. Explain an extension within the initial period.
Notify other recipients of the data, where the request triggered rectification, erasure, or restriction (Article 19).
Record the request and the response. The accountability principle requires you to be able to demonstrate how you handled it.

The DUAA also introduced a new statutory right for individuals to complain directly to a controller about how their personal data is being handled, separate from their existing right to complain to the ICO. Controllers must take steps to make this complaint route accessible — typically through an online form — and must acknowledge complaints within 30 days. This obligation is in force from June 2026.

Frequently asked questions

How long do I have to respond to a SAR?

Normally within one calendar month and without undue delay. A permitted extension can add up to two months for complexity or the number of requests. Necessary identity checks, clarification and permitted fees can affect when the clock starts or pauses.

Can I charge a fee for a SAR?

The first copy is free. A reasonable fee based on administrative costs can be charged for additional copies, or where a request is manifestly unfounded or excessive — though both thresholds are high.

What is the right to be forgotten?

The right to erasure under Article 17 — the right to have personal data deleted in specific circumstances. It is sometimes called the “right to be forgotten”, but it is not absolute. Exemptions apply, including where the data is needed to comply with a legal obligation or to defend legal claims.

Does the right to erasure always apply?

Erasure is conditional, not absolute. Information may need to be retained for legal duties or claims, and qualified exemptions cover public interest, expression and protected research or archiving. Assess the applicable legal test for the particular information.

Can I refuse a SAR?

A refusal needs a valid legal reason and a documented assessment. Explain it to the individual and provide the required information about complaining to the ICO or seeking a court remedy.

What’s changed under the DUAA for individual rights?

The amended UK GDPR permits qualifying significant solely automated decisions on an appropriate basis other than recognised legitimate interest, with required safeguards. Special category decisions remain subject to Article 22B restrictions. EU GDPR has different rules.

How do I make a SAR?

You can make a SAR in writing, by email, or verbally — to any part of the organisation. There is no required form. You only need to be clear that you are asking for your own data, and to provide enough information to allow the controller to verify your identity.

Make sure your team understands data subject rights and can handle requests correctly under UK data protection law.

Explore the GDPR & Data Protection Course →

Sources & references

Mark McShane

Health & Safety Training Specialist, Online CPD Academy

Mark writes about data protection, GDPR compliance and accredited online training for GDPR & Data Protection Course, part of Online CPD Academy.