The legal framework
After leaving the EU the UK retained the GDPR in domestic form. The UK GDPR and the Data Protection Act 2018 give rights of access, rectification, erasure, restriction, portability and objection, enforced by the Information Commissioner's Office. Reforms enacted in 2025 made targeted changes to research, automated decision-making and complaints handling.
Key points
| Subject access request | Free, answered within one month, extendable for complex requests |
|---|---|
| Erasure | Available where data is no longer needed or consent is withdrawn |
| Direct marketing | An absolute right to object |
| Regulator | Information Commissioner's Office, which can fine up to £17.5m or 4 % of global turnover |
| PECR | Separate rules on cookies, marketing emails and calls |
| Complaints | Organisations must now handle data protection complaints through a defined process before escalation |
| Special category data | Health, sex life and sexual orientation attract stricter conditions |
| UK GDPR | The retained version, amended by domestic legislation since leaving the European Union |
| No fee | Subject access requests are free unless manifestly excessive |
| One month | To respond, extendable by two months for complex requests |
| Compensation | Requires material or non-material damage; the courts have restricted low-value claims |
In practice
- Write to the organisation first, citing the relevant statutory right; keep proof of the date.
- Set out clearly what you want: a copy of your data, deletion, or an end to marketing.
- If there is no adequate reply within the statutory period, complain to the regulator — it is free.
- For dating, health and fertility apps, ask specifically about third-party sharing and overseas transfers.
- Send the request to the organisation's data protection officer and keep proof of delivery.
- If the deadline passes, complain to the ICO online — it is free and takes minutes.
Cost and coverage
All complaints and access requests are free.
Recent changes
The 2025 reforms adjusted several GDPR-derived rules while keeping the overall structure, in part to preserve the EU adequacy decision that allows data to flow freely to the UK.
Where to go
- Information Commissioner's Office — online complaint form and helpline.
- The organisation's own data protection officer, whose details must be published.
- Which? and Citizens Advice for consumer-facing issues.
Worth knowing
A subject access request is the most powerful and least used tool: it forces an organisation to show what it holds, where it came from and who it was shared with — often the foundation of any later complaint. The ICO rarely awards anything to the individual. It regulates; for compensation you must sue separately, which is only worthwhile for substantial harm.
Official sources and links
- GOV.UK — official portal for public services and rights
- legislation.gov.uk — the statute book as enacted and revised