Laws

UK GDPR: your data rights and how to use them

Quick answer

Under the UK GDPR you can ask any organisation for a free copy of the personal data it holds on you, and ask it to correct it, delete it or stop using it for marketing. It normally has one month to reply. If it ignores you, complain to the organisation first (it must acknowledge you within 30 days), then to the Information Commission, still at ico.org.uk.

“The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data”

From the law ( UK GDPR Article 15(1), legislation.gov.uk )

All privacy laws

Applies in: United Kingdom
In force since: 25 May 2018
Companies must answer within: One month, counted from the latest of three moments: the organisation receives your request, receives ID or other information it asked for, or receives a fee. It can add two more months for complex or numerous requests if it tells you, with reasons, within the first month. For access requests, the time it spends waiting for you to clarify what you want doesn't count (UK GDPR Articles 12 and 12A).
Regulator: Information Commission (still at ico.org.uk)
Last updated: 24 Oct 2026

By Anthon Wansland

Head of Product & Co-Founder

Reviewed by Ludwig Sandgren

Head of Legal

Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.

Sources checked: legislation.gov.uk, ico.org.uk

Last verified against the official page: 24 Oct 2026

How we research this Report an error

Organisations that use personal data about living people, whatever their size. The ICO says all organisations, regardless of their size, must consider your requests to use your rights. Information about someone who has died is no longer personal information.

Your rights

Right of access (subject access request)

Find out whether an organisation uses your data and get a copy, plus why it uses it, who it shared it with, how long it keeps it and where it got it. Since the 2025 Act the organisation only has to make a reasonable and proportionate search for it (Article 15).
Right to rectification

Have wrong data corrected without undue delay, and incomplete data completed, which can include adding a supplementary statement (Article 16).
Right to erasure (right to be forgotten)

Have your data deleted without undue delay when a ground applies: it's no longer needed, you withdraw consent, you object and win or object to direct marketing, it was used unlawfully, the law requires deletion, or it was collected from you as a child for an online service. In England and Wales, since 31 March 2026, it also covers data held because of a malicious allegation that the organisation investigated and closed with no further action (Article 17).
Right to object to direct marketing

Object at any time to your data being used for direct marketing, including profiling for it. The organisation must stop. The ICO says it can't refuse, though it may keep your name on a suppression list so it doesn't contact you again (Article 21).
Right to object to other uses

Object, for reasons to do with your situation, to use based on legitimate interests, recognised legitimate interests or a public task. The organisation must stop unless it shows compelling legitimate grounds or needs the data for legal claims (Article 21).
Right to restrict processing

Ask the organisation to store your data but not use it while accuracy or an objection is checked, or instead of deleting it when the use was unlawful or you need the data for a legal claim (Article 18).
Right to complain to the organisation

Since 19 June 2026 every organisation must give you a way to complain about how it handles your data, such as an online form. It must acknowledge your complaint within 30 days, look into it and tell you the outcome without undue delay (DPA 2018 s. 164A).

General information, not legal advice.

How to use it

1

Find who handles data requests

Look in the organisation's privacy notice for a privacy or data protection contact. You don't have to find a specific person: a request sent to any part of the organisation counts.
2

Send the request, preferably in writing

You can ask online, by email, by post, by phone or face to face, and there are no special words you have to use. Writing gives you proof. For a copy of your data, the ICO's free subject access request service writes the email for you (the button is Start your request for your information). To get data deleted, use our UK GDPR erasure request template.
3

Say exactly what you want

For an access request, the ICO suggests a "subject access request" heading, the date, your name and any previous names, your contact details, account or customer numbers, the information you want with any date ranges, and how you want to receive it. For deletion, give your identifying details and say which data you want erased.
4

Answer ID checks, but only with what's needed

The ICO expects ID checks when the data is sensitive (health or financial records, for example) or your details don't match the organisation's records. It should ask only for enough to be sure you're the right person. The one-month clock starts when it has that information.
5

Keep records and wait one month

Save copies of what you sent, screenshots of online forms and proof of postage. The organisation normally has one month, or up to three in total for complex or numerous requests if it tells you within the first month. It can't normally charge. A reasonable fee is only allowed for manifestly unfounded or excessive requests, or for extra copies.
6

Complain to the organisation

If there's no reply, or the reply isn't good enough, complain to the organisation and say clearly that it's a data protection complaint. By law it must acknowledge it within 30 days (counting from the day after it receives it), look into it and tell you the outcome without undue delay. There's no fixed deadline for the outcome itself.
7

Complain to the Information Commission

If you're still unhappy, go to the ICO's data protection complaints page and press Start now. The questions take about 5 minutes and tell you whether you can complain yet. Have ready the organisation's email address, a copy of your complaint to it, a copy of your original request and any evidence of harm.
8

Go to court if you want compensation

The regulator can't award compensation. You can claim it from the organisation directly, or enforce your rights in court if it won't pay. The ICO advises getting independent legal advice first.

No answer in time? Complain to Information Commission (still at ico.org.uk) .

What changed in 2025 and 2026

The Data (Use and Access) Act 2025 amended the UK GDPR in stages, and most of it is now in force.

5 February 2026. A new Article 12A sets out when the one-month clock starts: the latest of the day the organisation gets your request, the day it gets ID or information it asked for, and the day you pay any fee. It also lets the organisation pause the clock while it asks you to clarify an access request. Article 15 now says the organisation only has to make a reasonable and proportionate search, a change that applies retrospectively from 1 January 2024.

31 March 2026. In England and Wales, erasure now also covers data kept because of a malicious allegation that the organisation looked into and closed with no further action.

19 June 2026. Every organisation must run a data protection complaints process and acknowledge your complaint within 30 days. That's why the steps above send you to the organisation before the regulator.

30 September 2026. The Information Commission replaced the Information Commissioner. The website is still ico.org.uk and still calls itself the ICO. Much of its public guidance carries a banner saying it's under review because of the Act, so check the page itself before relying on exact wording.

Why an organisation can say no

Erasure isn't absolute. An organisation can keep data it needs for freedom of expression, to meet a legal obligation, for a public interest task or official authority, for public health, for archiving or research, or for legal claims. If you object to a use other than marketing, it can carry on if it shows compelling legitimate grounds. It can also charge or refuse when a request is manifestly unfounded or excessive.

Marketing is the exception. Once you object to direct marketing, it has to stop.

The UK GDPR is the UK's own version of the EU GDPR as it stood at 11pm on 31 December 2020, read alongside the Data Protection Act 2018. The rights still line up closely, but the UK changes above don't apply in the EU. If a company handles your data in an EU country, see our GDPR page.

Where Serus fits

These rights work one organisation at a time, and the data brokers and people-search sites that list you are a lot of organisations. Serus finds the ones that operate where you live, sends the removal requests, follows up when the month runs out and checks whether your details come back. If you'd rather do it yourself, the steps above and the ICO's free tools are enough. Run a free scan to see where you're listed.

Data brokers that list people in United Kingdom

Each guide shows how to opt out of that site, step by step.

All data broker guides

Let Serus send the requests for you

Serus finds the data brokers that list you where you live and removes you from them.

Run a free scan

Frequently asked

Is a subject access request free in the UK?

Normally, yes. A reasonable fee is only allowed when a request is manifestly unfounded or excessive, or for further copies. If the organisation does charge a fee, the one-month clock doesn't start until you've paid it.

How long does an organisation have to reply?

One month. It can extend that by two further months for complex or numerous requests, but only if it tells you why within the first month.

Can an organisation stop the clock on my request?

For access requests, yes, since 5 February 2026. If it reasonably needs you to clarify what you're after (for example because it holds a lot of data about you), the time until you reply doesn't count.

Do I have to complain to the organisation before going to the ICO?

The ICO recommends it. Raise the problem with the organisation first and give it a chance to put things right. Since 19 June 2026 it must have a complaints process and acknowledge your complaint within 30 days.

Does objecting to marketing delete my data?

Not automatically. The organisation must stop direct marketing to you, but it will probably keep your name on a suppression list so it doesn't contact you again. Ask for erasure separately if you want the rest deleted.

Can the ICO award me compensation?

No. You can claim compensation from the organisation directly, or through the courts if it won't pay.

Sources

Something wrong or out of date? Tell us and we'll re-check it.

Your rights

How to use it

Find who handles data requests

Send the request, preferably in writing

Say exactly what you want

Answer ID checks, but only with what's needed

Keep records and wait one month

Complain to the organisation

Complain to the Information Commission

Go to court if you want compensation