Your data protection rights in the UK: a complete guide

An old account you forgot about still holds your details. A company you never dealt with sends you marketing. A firm you left years ago keeps a file on you. In each case, data protection law gives you ways to act. This guide goes through them one by one, using only the pages published by the Information Commissioner's Office (the ICO), the UK regulator for data protection. When those pages do not cover a point, we say so instead of guessing.

What to do first

If you want to act today, this is the order the ICO guidance points to.

1. Work out which right fits your situation. The table in the next section matches each right to the question it answers.
2. Contact the organisation that holds your information. You do not need a lawyer, and you do not have to find a specific person.
3. Put your request in writing, even if you also speak to someone. A written message gives you proof of what you asked and when.
4. Keep copies of everything you send and receive.
5. If the answer is a refusal, or there is no answer, complain to the organisation. Only after that, consider taking the matter to the ICO.

Your rights at a glance

The table below follows the ICO's list. The sections after it add what the sources explain in depth.

Organisations often need your personal information to provide their services, but the ICO stresses that this does not mean you lose control over it.

Who these rights belong to

Your own information only

You only have rights over your own personal information. You do not have rights over other people's personal information, even if they are family members.

Acting for someone else

There is an exception for helping others. In some cases, you can act on someone's behalf to help them use their information rights. The ICO is clear that you will need to prove that you have the authority to act for them. The complaints guidance gives examples of acceptable proof: an appropriate power of attorney, or a signed letter of authority from the person you are acting for.

The subject access request service adds that, for a request made for someone else such as a child or relative, you provide proof of ID and address for them, not for you, plus evidence that you may act, such as a signed letter of consent, a power of attorney or proof of parental responsibility.

Someone who has died

Information about someone who has died is no longer considered personal information. Data protection rights and rules do not apply to it. This means you cannot use these rights on behalf of someone who has died.

How to make a request

You can do it yourself

You do not need a lawyer to use your rights, and you should not need to spend time or money either. You ask the organisation yourself, which the ICO calls making a request. All organisations, regardless of their size, must consider your requests and respond appropriately.

Verbally or in writing

For erasure, you can make your request verbally or in writing, and you can contact any part of the organisation. There are no specific words you must use. The ICO still recommends following up a verbal request in writing, because it lets you explain your concern and give evidence, and it gives you clear proof if you later challenge the response.

Where to find contact details

The subject access request page tips that you can usually find a suitable email address in the organisation's privacy notice.

Refusals are possible

There are times when organisations can refuse your request, or when you may not get the outcome you want. If an organisation refuses, it should usually explain why. The grounds are spelled out in the sources for erasure only.

The right of access and subject access requests

The right of access lets you ask whether an organisation is using or storing information about you, for copies of that information, and why and how it is using it. A request for copies is known as a subject access request.

The ICO's request service

The ICO runs an online service that creates an email to the organisation you specify, containing your request and everything it needs to respond. You also get a copy for your records. The organisation should reply to you directly, and the ICO will not see the reply. The service takes about 10 minutes.

What you need

You need the name of the organisation and its email address. The ICO says you should also provide proof of ID (a copy of a passport or driving licence) and proof of address (a copy of a bank statement, utility bill or TV licence).

Time to respond

The complaints guidance says the organisation has to take reasonable and proportionate steps to find your personal information and respond without an unnecessary or unjustifiable delay, within one calendar month at the latest, which it can extend for complex requests. The request page itself gives no separate deadline.

The right to erasure

The right to erasure is the most detailed right in the sources. The ICO also calls it the right to get your data deleted, and says you may hear it called the right to be forgotten. Because of changes made by the Data (Use and Access) Act, the ICO says this guidance is under review and may change.

When you can ask for deletion

You can ask an organisation that holds data about you to delete it. In some circumstances, it must then do so. The ICO says the right only applies in these circumstances:

• The organisation no longer needs your data for its original purpose. After you cancel a gym membership, the gym no longer needs your name, address, age and health conditions.
• You withdrew your consent. You agreed to take part in a market research study and now do not want to.
• You objected and your interests outweigh the organisation's.
• You objected to the use of your data for direct marketing.
• The organisation collected or used your data unlawfully.
• The organisation has a legal obligation to erase your data.
• The data was collected from you as a child for an online service, such as social media or a gaming app. Even as an adult, you keep this right.

How to ask

Contact the organisation and say what personal data you want erased. The ICO offers a template letter with your contact details, the date, the organisation's name and address, a reference number if you have one, and the heading "Right to erasure". You identify yourself, state that you wish to exercise your right of erasure under data protection law, and describe the data. The template asks for a full response within one calendar month, and for the organisation to say when it can respond if it cannot meet that timescale.

What the organisation should do

The organisation should delete your data, unless an exemption applies. It should also tell anyone else it has shared your data with, unless that is impossible or involves disproportionate effort, and if you ask it must tell you which organisations it shared it with. If your data was made public online, for example on social networks, forums or websites, it must take reasonable steps to inform those responsible for the sites so that links or copies are erased. If it decides not to erase, it must still respond, explain why, and tell you about your right to complain to the ICO or through the courts.

When the organisation can say no

The ICO lists these grounds for refusing:

• keeping the data is necessary for freedom of expression and information, including journalism and academic, artistic and literary purposes;
• the organisation is legally obliged to keep it, for example under financial or other regulations;
• it is carrying out a task in the public interest or exercising official authority;
• keeping it is necessary to establish, exercise or defend legal claims;
• erasure would prejudice scientific or historical research, or archiving in the public interest.

Special category data has two further exceptions, for public health in the public interest, and for medical and health or social care purposes when the data is used by or under the responsibility of a professional bound by professional secrecy. An exemption can lead to a full or partial refusal.

The organisation can also refuse a request that is, in the law's words, manifestly unfounded or excessive. There is no set definition. The ICO's example is a request clearly made only to harass or disrupt the organisation. It can then ask for a reasonable fee or refuse, and must tell you and justify its decision.

Rectification, objection, restriction and portability

The ICO page links each of these rights to its own guidance, which was not among our sources. We can only report the short descriptions.

• Rectification: you can ask an organisation to correct inaccurate information about you. The sources give no evidence requirements or time limit for this right.
• Objection: you can ask an organisation not to use information about you. It connects to erasure, since an objection that succeeds, or an objection to direct marketing, can support a deletion request. The conditions for success are not set out.
• Restriction: you can ask an organisation to limit how it uses information about you. When it applies and how long it lasts are not described.
• Portability: you can ask an organisation to transfer information about you to another organisation. Which data is covered and in what format are not described.

For all four, the advice from the other pages still applies: contact the organisation, keep a written record, and use the complaints route if you do not get a proper answer.

The right to be informed and automated decisions

The right to be informed

You have the right to be told about the use of your personal information. The ICO says an organisation should tell you what it is doing with information about you, why it has it, and how you can contact it.

Automated decisions

Some decisions are made about people with no human involvement. If an organisation makes a significant decision about you based solely on automated processing, you are able to:

• make representations about the decision;
• contest the decision;
• ask for a human to review it.

A significant decision, according to the ICO, is one that has a legal or similarly significant effect on you. Organisations need to give you information about all automated processing they carry out about you.

One caution from the ICO: its guidance on automated decision making, including profiling, is aimed at organisations and is currently in draft form. Further guidance is expected later in 2026. If you rely on this right, check the ICO website for updates.

Time limits, fees and proof of identity

The one-month rule

The only detailed time limit in the sources concerns erasure. An organisation has one calendar month to respond. In certain circumstances it may need extra time to consider your request and can take up to an extra two months. If it intends to do this, it should tell you within one month that it needs more time and give the reasons. The ICO refers readers to its separate guidance on time limits for more.

The complaints guidance repeats the one calendar month limit for subject access requests, extendable for complex requests. For the other rights, the sources state no deadline.

When the clock starts

The organisation might need you to prove your identity. It should only ask you for just enough information to be sure you are the right person. If it asks, the one-month period begins from when it receives this additional information.

Fees

In most circumstances, an organisation cannot charge a fee. It can only do so if the request is manifestly unfounded or excessive, and then it may ask for a reasonable fee for the administrative costs of your request.

Search engines, websites and published information

Many readers come to this subject because something about them appears in search results. The ICO pages we used do not describe a separate right to ask a search engine to stop showing a result, and they do not mention search engines at all.

What they do say is relevant in two ways. The erasure page covers data made public online, such as on social networks, forums or websites, and requires the organisation to take reasonable steps to inform those responsible for the sites. The ICO therefore describes a duty to take reasonable steps where erased data was made public. The erasure exemptions, such as keeping information for reasons of freedom of expression, can also come into play. Describe precisely what you want removed and why. For delisting questions beyond this, the sources are silent.

When the organisation does not respond or you disagree

Raise a complaint with the organisation first

If you are unhappy with how an organisation handled your request, the ICO says you should first raise a complaint with it and give it the opportunity to resolve the matter. If you remain dissatisfied after that, you can complain to the ICO.

Rights request or complaint?

The ICO draws a clear line between the two. A rights request usually asks the organisation to do something with your information, such as respond to your request for a copy or consider whether it can delete something. A complaint is when you tell the organisation that you do not think the way it handled your information followed data protection law. That can be about how it handled your rights request, or about something else.

The ICO's examples include how the organisation handled a request for copies of your information, a worry that it has not kept your information secure (for example after a data breach), how it collected or used your information, and how it handled any other rights request.

The two follow different rules, even if they concern the same issue and are sent at a similar time. If you send both together, the organisation should deal with them separately. Where you also raise a non-data protection issue, such as a grievance with your employer or a customer service problem, the organisation only has to answer the rights request under data protection law and should treat the rest separately.

How to complain to the organisation

Organisations must have a data protection complaints process. Depending on the organisation, you may be able to use a complaint form, a complaints page on its website, a verbal complaint by phone or in person, or a dedicated complaints email address. To learn the process, read its privacy policy, look for a complaints section on its website, or ask it directly.

The ICO warns that if you do not follow the organisation's process, your complaint may not reach the right team or may be missed. If there is a dedicated web page, avoid complaining via social media, which is also not generally a secure way to send personal information. If there is no complaint form, the ICO offers a template to send by email or post. Whatever method you use, keep a record of your complaint, and follow a verbal complaint up in writing where possible.

What to put in a complaint

The ICO suggests saying clearly that it is a data protection complaint, giving reference and account numbers, your contact details and relevant dates, and summarising what went wrong and how to put it right. Use your own words, with no legal terms needed, and list your concerns as short, separate points. Say if the issue has affected you or may put you at risk of harm. Send copies of key documents only, keep the originals safe, and aim for around 500 words. You can also say how the organisation can help you, for example if you are under 18 or have accessibility needs.

What to expect in return

The organisation has 30 days to acknowledge your complaint, counting from the day after it receives it, or until the next working day if the 30 days end on a weekend or public holiday. This is not a deadline to resolve it, only to confirm receipt. The organisation then needs to look into the complaint, keep you up to date, and give an outcome without an unjustifiable or excessive delay. Data protection law sets no specific time limit for the outcome. You can ask for an update if you have not heard for a while.

If the response does not satisfy you

You can ask for more details or a clearer explanation, summarising the outstanding issues and allowing a reasonable time. You can also complain to the ICO at any time, although it recommends letting the organisation complete its own process first, which may let the ICO handle your complaint more quickly.

Complaining to the ICO, the courts and compensation

The ICO

The pages we used do not detail the ICO's own process. They say the ICO will handle your complaint under its complaints handling framework, and they point to separate advice on making a complaint to the ICO. They also note that if your complaint concerns a different law or an area handled by another regulator, the ICO cannot look into it. You might then need to complain to the ICO about the data protection part and to another service about the rest.

Compensation

You can claim compensation directly from an organisation if you have suffered damage as a result of it breaking data protection law. The ICO cannot award compensation or advise on compensation claims.

The courts

You can also seek to enforce your rights through the courts. The ICO strongly advises you to seek independent legal advice first if you decide to do this.

How a free analysis fits in

Remove Me offers a free analysis, with no account needed. You enter your details, and the service searches publicly visible web results, known public data breaches (through Have I Been Pwned) and a register of data brokers, then shows you a report. The report is unlocked with a 6-digit code sent by email.

Remove Me does not yet send erasure requests on your behalf. The analysis shows what is visible, and the requests described in this guide remain yours to make, using the steps and templates the ICO provides.

What the sources do not cover

Some points are not in the ICO pages we used: deadlines for rights other than erasure and access, detailed conditions for rectification, objection, restriction and portability, search-engine delisting, and the ICO's own complaints process. The ICO also says several pages are under review because of the Data (Use and Access) Act, so check its site for the latest wording.

The message of the ICO pages is consistent. Your rights belong to you, you can use them without a lawyer, and when an organisation falls short there is a clear ladder: ask, complain to the organisation, then complain to the ICO or turn to the courts.