The UK GDPR gives individuals control over how organisations use their personal data. For businesses, the practical task is to recognise requests quickly, apply the correct legal test and keep a clear record of the decision. This article is part of the reference collection published by Harper James.
Individuals have the right to be informed, access their personal data, correct inaccurate information and request erasure in certain circumstances. They can also ask an organisation to restrict processing, receive data in a commonly used machine-readable format, and object to processing based on legitimate interests or direct marketing. Additional protections apply to solely automated decisions that produce legal or similarly significant effects. The right to erasure is not absolute, and an organisation can retain information where a legal obligation or the establishment, exercise or defence of legal claims requires it. Further reading on UK GDPR rights provides a useful starting point for checking the detail of each right.
A practical workflow starts with logging the request, confirming the requester’s identity where necessary and identifying the relevant systems, teams and processors. Most requests must be answered without undue delay and within one month. That period can be extended by up to two further months where a request is complex or numerous, but the individual must be told within the first month and given the reason. Organisations should provide information in a concise, transparent and accessible form. A reasonable fee is available only in limited cases, such as manifestly unfounded or excessive requests, and refusal requires a documented explanation.
Businesses should maintain a rights-request procedure, train staff to forward requests to the right team and use search terms that cover email, customer platforms, shared drives and archived records. They should record the request, identity checks, applicable exemptions, searches completed, information supplied and response date. The Data (Use and Access) Act 2025 introduced amendments to the UK data protection framework, with provisions commencing in stages. Organisations should therefore track current Information Commissioner’s Office guidance and commencement information rather than relying on an old template. A regular review also helps identify repeat problems, such as privacy notices that do not match actual processing or retention periods that prevent effective responses.