Data protection
After leaving the EU the UK retained the GDPR in domestic form. The UK GDPR and the Data Protection Act 2018 give rights of access, rectification, erasure, restriction, portability and objection, enforced by the Information Commissioner's Office. Reforms enacted in 2025 made targeted changes to research, automated decision-making and complaints handling.
Key points
| Subject access request | Free, answered within one month, extendable for complex requests |
|---|---|
| Erasure | Available where data is no longer needed or consent is withdrawn |
| Direct marketing | An absolute right to object |
| Regulator | Information Commissioner's Office, which can fine up to £17.5m or 4 % of global turnover |
| PECR | Separate rules on cookies, marketing emails and calls |
| Complaints | Organisations must now handle data protection complaints through a defined process before escalation |
| Special category data | Health, sex life and sexual orientation attract stricter conditions |
| UK GDPR | The retained version, amended by domestic legislation since leaving the European Union |
| No fee | Subject access requests are free unless manifestly excessive |
| One month | To respond, extendable by two months for complex requests |
| Compensation | Requires material or non-material damage; the courts have restricted low-value claims |
In practice
- Send the request to the organisation's data protection officer and keep proof of delivery.
- If the deadline passes, complain to the ICO online — it is free and takes minutes.
Cost and coverage
All complaints and access requests are free.
Recent changes
The 2025 reforms adjusted several GDPR-derived rules while keeping the overall structure, in part to preserve the EU adequacy decision that allows data to flow freely to the UK.
Where to go
- Information Commissioner's Office — online complaint form and helpline.
- The organisation's own data protection officer, whose details must be published.
- Which? and Citizens Advice for consumer-facing issues.
Worth knowing
A subject access request is the most powerful and least used tool: it forces an organisation to show what it holds, where it came from and who it was shared with — often the foundation of any later complaint. The ICO rarely awards anything to the individual. It regulates; for compensation you must sue separately, which is only worthwhile for substantial harm.
The general article: Data protection · Compare with another country
Privacy
English law never recognised a free-standing privacy tort. Instead the courts developed the tort of misuse of private information, anchored in Article 8 of the European Convention as incorporated by the Human Rights Act 1998. Alongside it, the UK GDPR and the Data Protection Act 2018 govern personal data and are enforced by the Information Commissioner's Office.
Key points
| Main claim | Misuse of private information: a reasonable expectation of privacy, then a balance against free expression |
|---|---|
| Statute | UK GDPR and Data Protection Act 2018 |
| Regulator | Information Commissioner's Office, free to complain to |
| Harassment | Protection from Harassment Act 1997, civil and criminal |
| Injunctions | Available, including before publication |
| Limitation | One year for defamation; longer for privacy claims, but act quickly |
| Interim injunctions | Available before publication, with the court weighing Article 8 against Article 10 |
| Anonymity orders | Can prevent the parties being identified in reports of the case |
| Vicarious liability | Employers can be liable for misuse of data by employees, though the courts have narrowed this |
In practice
- Act within days if publication is imminent: delay defeats an application for an injunction.
Where to go
- Information Commissioner's Office.
- Solicitors specialising in media and privacy law.
- Citizens Advice for a first assessment.
Worth knowing
Privacy litigation in England is expensive and costs usually follow the event: a losing claimant can be ordered to pay the other side's legal bill. Test the regulator route first. Costs in privacy litigation frequently exceed the damages awarded. Weigh the regulator route and a platform complaint before issuing proceedings.
Image rights
English law gives no property right in your likeness. Control over photographs comes from the tort of misuse of private information, from data protection law where the image identifies you, and from criminal offences. The Online Safety Act 2023 made sharing intimate images without consent an offence without needing to prove an intention to cause distress, and creating sexually explicit deepfakes has since been addressed by further reform.
Key points
| General rule | Photographing a person in a public place is generally lawful |
|---|---|
| Privacy claim | Misuse of private information where there is a reasonable expectation of privacy |
| Data protection | An identifiable image is personal data; erasure can be requested |
| Intimate images | Sharing without consent is a criminal offence under the Online Safety Act 2023 |
| Deepfakes | Sexually explicit synthetic images of a real person are covered by recent reform |
| Children | Schools and clubs normally require parental consent as a matter of data protection |
| Photographs as private information | Courts treat images as especially intrusive, even of activities in public |
| Removal duties | Regulated services must act on reports of intimate image abuse |
In practice
- Report to the platform and to the Revenge Porn Helpline at the same time; both routes work in parallel.
Recent changes
The Online Safety Act 2023 removed the requirement to prove intent to cause distress, which had made the previous offence very hard to use.
Where to go
- Report Harmful Content, run by the UK Safer Internet Centre.
- Revenge Porn Helpline.
- Police, by dialling 101, or 999 if there is an immediate risk.
Worth knowing
There is no general right to stop someone photographing you in the street. What changes the analysis is the setting, the content, and what is then done with the picture. Courts treat photographs as more intrusive than a written description of the same facts. That makes image claims stronger than they appear.
The general article: Image rights · Compare with another country
Speech and online harassment
A serious-harm threshold for defamation, a one-year limitation period, and a new suite of online safety duties.
The Defamation Act 2013 requires a claimant to show that a statement has caused or is likely to cause serious harm to reputation, with a serious financial loss test for companies. It provides defences of truth, honest opinion and publication on a matter of public interest. The Online Safety Act 2023 imposes duties on platforms and created new communications offences.
Key points
| Serious harm | Required for any defamation claim |
|---|---|
| Limitation | One year from publication |
| Defences | Truth, honest opinion, public interest, and website operator defences |
| Malicious falsehood | Alternative where reputation is not the issue |
| Communications offences | False communications and threatening communications offences replaced older provisions in 2023 |
| Intimate images | Sharing without consent, and threatening to share, are criminal offences |
| Harassment | Protection from Harassment Act covers a course of conduct, with civil and criminal routes |
| Serious harm test | A statement is not defamatory unless it has caused or is likely to cause serious harm |
| One-year limitation | Defamation claims must be brought within twelve months |
| Online Safety Act | Created false and threatening communications offences and platform duties |
| Malicious Communications | A separate offence covering grossly offensive messages sent to cause distress |
In practice
- Send a letter of claim setting out the words complained of and the harm caused.
- Report threatening or false communications to the police as well as to the platform.
Cost and coverage
Defamation litigation is expensive; harassment and intimate image offences are pursued through the police at no cost.
Recent changes
The Online Safety Act's duties are being phased in by Ofcom, including requirements for platforms to act against illegal content and to protect children.
Where to go
- Report Harmful Content, operated by the UK Safer Internet Centre.
- Revenge Porn Helpline, which secures removals internationally.
- Police online reporting for threats and harassment.
Worth knowing
The Revenge Porn Helpline has an extremely high removal rate and works directly with platforms — a far faster route than legal proceedings for intimate image abuse. The one-year limitation period runs from publication, not from when you found out. It is strictly enforced and rarely extended.
The general article: Speech and online harassment · Compare with another country
Copyright
Fair dealing, not fair use: only the listed purposes are permitted, and the list is closed.
The Copyright, Designs and Patents Act 1988 protects original works for the author's life plus seventy years. The crucial difference from American law is that the United Kingdom has fair dealing, not fair use: a use is permitted only if it falls within a specific listed purpose — quotation, criticism or review, news reporting, parody, caricature or pastiche, private study — and is fair. There is no open-ended balancing test.
Key points
| Statute | Copyright, Designs and Patents Act 1988 |
|---|---|
| Term | Life of the author plus 70 years |
| Fair dealing | Closed list of purposes; no general fair use defence |
| Parody | Permitted since 2014, within fair dealing limits |
| Freedom of panorama | Section 62: you may photograph buildings and public sculptures freely |
| Moral rights | Paternity right must be asserted in writing to be enforceable |
| Orphan works | A licensing scheme exists for works whose owner cannot be traced |
| Crown copyright | Government material is covered by its own licence, often permitting reuse |
| Text and data mining | Permitted for non-commercial research only |
In practice
- Use the Open Government Licence for official material rather than assuming it is free.
Where to go
- Intellectual Property Office guidance.
- Collecting societies: PRS, PPL, DACS, ALCS.
- Own It and other free creator advice services.
Worth knowing
The paternity right — the right to be identified as author — is not automatic in the United Kingdom: it must be asserted, usually in writing in the work itself. Fair dealing requires both a listed purpose and fairness. Satisfying only one of the two is the most common mistake.
The general article: Copyright · Compare with another country
Identity theft
Identity theft is not itself a crime — the fraud committed with your identity is. Protective registration is the practical defence.
There is no offence of identity theft in English law. The Fraud Act 2006 punishes fraud by false representation, which is what someone using your details commits. Reporting goes to Report Fraud rather than to a local police station, and the most useful protective step is a Cifas protective registration, which flags your identity for extra checks.
Key points
| Offence | Fraud by false representation, under the Fraud Act 2006 |
|---|---|
| Reporting | Report Fraud, online or by phone; City of London Police analysts assess cases |
| Protective registration | Cifas, for an annual fee, flags applications made in your name |
| Credit files | Experian, Equifax and TransUnion; statutory credit reports are free |
| Bank liability | Unauthorised payments must be refunded unless you acted fraudulently or with gross negligence |
| APP fraud | Mandatory reimbursement rules apply to authorised push payment scams |
| Reimbursement rules | Authorised push payment scam victims must be reimbursed by the sending bank in most cases |
| Financial Ombudsman | Free escalation if the bank refuses |
| Credit report notices | A notice of correction can be added to explain disputed entries |
In practice
- Contact your bank immediately and ask for the fraud team; ask them to record it formally.
- Report to Report Fraud and keep the crime reference number: everyone else will ask for it.
- Check all three credit reference files and dispute every entry you do not recognise.
- Take out a Cifas protective registration and change passwords, starting with your email.
- Escalate to the Financial Ombudsman Service if the bank refuses: it is free and its decisions bind the bank.
Where to go
- Report Fraud.
- Cifas protective registration.
- Citizens Advice consumer helpline.
Worth knowing
Your email account is the master key: it can reset everything else. Secure it first, with a new password and two-factor authentication, before you do anything else. The mandatory reimbursement rules for push payment scams shifted the default. A bank refusing to refund now has to justify it.
The general article: Identity theft · Compare with another country
Online shopping
Fourteen days to cancel most online orders, a 30-day right to reject faulty goods, and chargeback or section 75 protection on cards.
The Consumer Contracts Regulations give a 14-day cooling-off period for most distance sales. The Consumer Rights Act 2015 provides a short-term right to reject faulty goods within 30 days, then repair or replacement, then a price reduction. The Digital Markets, Competition and Consumers Act 2024 added rules on fake reviews and subscription traps.
Key points
| Cooling-off | 14 days from delivery, no reason needed; 12 months if not properly informed |
|---|---|
| Right to reject | 30 days for faulty goods, with a full refund |
| After 30 days | Repair or replacement, then price reduction or final rejection |
| Digital content | Must be of satisfactory quality and as described |
| Section 75 | Credit card issuer is jointly liable for purchases between £100 and £30,000 |
| Chargeback | Available on debit cards through the card scheme rules |
| Subscriptions | New rules target automatic renewals and difficult cancellation |
| Thirty-day right to reject | A short-term right to a full refund for faulty goods |
| Six years | Claims for defective goods can be brought for up to six years in England and Wales |
In practice
- Use section 75 against the card issuer when a trader fails or refuses to refund.
- Reject faulty goods within thirty days for a full refund rather than accepting a repair.
Cost and coverage
Complaints and ombudsman schemes are free to consumers.
Recent changes
The 2024 Act gave the Competition and Markets Authority direct enforcement powers, without needing to go to court first — a significant change for consumer protection.
Where to go
- Citizens Advice consumer helpline.
- Your card issuer for section 75 and chargeback claims.
- Relevant ombudsman schemes and the CMA for market-wide problems.
Worth knowing
Section 75 is the strongest consumer right in the UK: for anything over £100 bought on a credit card, the card company is equally liable if the goods never arrive or are misdescribed. Section 75 makes the credit card company jointly liable with the trader. It is the strongest consumer remedy in the United Kingdom and is widely unknown.
The general article: Online shopping · Compare with another country
Romance scams
Mandatory reimbursement for authorised push payment fraud since October 2024 — the strongest consumer protection anywhere.
Since October 2024, banks must reimburse victims of authorised push payment fraud up to a set cap, with the cost shared equally between the sending and the receiving bank, unless the customer acted with gross negligence. Reporting goes to Report Fraud for England, Wales and Northern Ireland, and to Police Scotland in Scotland. Suspicious texts are forwarded to 7726 and suspicious emails to the national reporting service.
Key points
| Reimbursement | Mandatory for authorised push payment fraud since October 2024, up to a cap |
|---|---|
| Cost sharing | Split equally between sending and receiving bank |
| Deadline to claim | Within thirteen months of the last payment |
| Reporting | Report Fraud; Police Scotland in Scotland |
| Suspicious texts | Forward free to 7726 |
| Suspicious emails | Forward to the national suspicious email reporting service |
| If refused | Escalate free of charge to the Financial Ombudsman Service |
In practice
- Claim reimbursement from your own bank in writing, citing the mandatory reimbursement rules — do not accept a verbal refusal.
- If the bank refuses, the Financial Ombudsman Service is free, independent and decides in the consumer's favour in a substantial share of fraud cases.
- Forward scam texts to 7726 and scam emails to the national reporting service: both are free and lead to takedowns.
- Report to Report Fraud even where nothing was lost — the reference number is what links cases together.
Cost and coverage
Reporting, the ombudsman and the consumer service are all free.
Recent changes
The mandatory reimbursement rules that took effect in October 2024 reversed the previous position, under which banks routinely refused authorised-payment claims.
Where to go
- Report Fraud, or Police Scotland on 101 in Scotland.
- Your bank's fraud line, first and immediately.
- Financial Ombudsman Service, if reimbursement is refused.
- Citizens Advice consumer service, for free guidance.
Worth knowing
The reimbursement duty applies to payments between UK accounts. Transfers sent abroad, and cryptocurrency, fall outside it — which is exactly why scammers push victims towards both.
Sources
- Report Fraud — national reporting centre (formerly Action Fraud), or 0300 123 2040
- Call 159 — Stop Scams UK: a safe number that connects you straight to your bank
- Forward scam texts to 7726 — free, on every major network
- Financial Ombudsman Service — free and independent if the bank refuses to reimburse
- Citizens Advice — free consumer guidance and template letters
- FCA Warning List — unauthorised firms and clones: check before any investment suggested online
- National Cyber Security Centre — alerts and guidance for individuals; report scam websites and emails
The general article: Romance scams · Compare with another country
General sources
- GOV.UK — official portal for public services and rights
- legislation.gov.uk — the statute book as enacted and revised