17.8 UK data rights and remedies

Status reviewed 1 October 2026. All data-protection provisions of the Data (Use and Access) Act 2025 were in force by 19 June 2026. The Information Commissioner's Office transitioned to the Information Commission on 30 September 2026, while continuing to be known as the ICO and maintaining its regulatory functions.

This page gives general information about the ordinary UK data-protection regime, not advice on litigation, law-enforcement files, intelligence processing, journalism, employment, or a particular exemption.

What changed

The Data (Use and Access) Act 2025 amended rather than replaced the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations. It also:

• created a statutory structure for registered digital verification services;
• enabled smart-data schemes;
• changed aspects of cookies and electronic communications;
• altered regulator powers and governance;
• amended parts of online-safety law.

For you as an individual, the most visible data-protection changes are:

• an express statutory complaints process that organisations must run;
• subject-access searches need only be reasonable and proportionate;
• the clock can pause in defined circumstances while an organisation seeks clarification;
• a broader route for significant automated decisions not involving special-category data, with safeguards;
• some processing purposes get clearer or recognised legitimate-interest treatment.

The Act did not remove the core rights listed below.

The rights that remain

Rights are conditional tools, not magic words. Which one applies depends on why the organisation processes the data, what the data is, whether an exemption applies, and whether competing rights such as freedom of expression are engaged.

So pick the request that matches the outcome you need.

Access

A subject access request asks whether an organisation processes your personal data and, if so, for a copy plus supporting information: purposes, categories, recipients, retention, source, your rights, and relevant automated-decision information.

No special form is needed, and you do not have to say "subject access request". A clear written request is easier to prove.

Timing and effort:

• One month is the normal response period, with a possible extension for complexity or multiple requests.
• The organisation can ask for information reasonably needed to verify your identity.
• Since the 2025 Act, it may ask for clarification where reasonably required to identify the information or processing you want. The statutory clock can pause while it waits.
• It only has to make reasonable and proportionate searches, not every technically imaginable one.

Narrowing by account, date, system, transaction or event often gets you a faster and more useful result.

Myth: access means unredacted copies of every document. Reality: the organisation must protect other people's data and may rely on exemptions. Your right is to your personal data and the required context, which may come as extracts or an intelligible compilation rather than the original file.

Correction, erasure, and restriction

Rectification is for data that is inaccurate or incomplete. State the disputed field, the correct value and your evidence.

An opinion is not necessarily inaccurate just because you disagree with it, but a record may need your challenge or context attached.

Erasure applies in defined circumstances, for example:

• the data is no longer needed for its purpose;
• consent is withdrawn and no other basis remains;
• a valid objection succeeds;
• processing was unlawful;
• deletion is legally required.

It is not an absolute right. Legal obligations, claims, public tasks, health and research rules, and freedom of expression can justify keeping data. If the organisation refuses, ask it to identify the basis and the retention period.

Restriction is useful while accuracy, lawfulness or an objection is being sorted out. It preserves the data but limits active use. That can be safer than immediate deletion where records may be evidence of fraud, harassment, discrimination or a complaint.

Objection and direct marketing

You can object to processing based on public task or legitimate interests, on grounds relating to your situation. The organisation must stop unless it demonstrates compelling legitimate grounds overriding your interests, rights and freedoms, or needs the data for legal claims.

So an objection works better with a concrete explanation of harm, vulnerability, inaccuracy or disproportion.

The right to object to direct marketing is stronger: it is absolute. The organisation should stop using your data for that marketing. It may keep a minimal suppression record so it does not accidentally add you again; deleting every trace can actually undermine the opt-out.

Portability

Data portability covers data you provided, processed by automated means on the basis of consent or contract. You can receive it in a structured, commonly used, machine-readable form and, where technically feasible, have it transmitted to another controller.

It is narrower than access and does not force a company to reveal every inferred score or proprietary system.

Automated decisions after the 2025 Act

The amended regime permits more solely automated decisions with legal or similarly significant effects, as long as the organisation has a valid lawful basis. Previously, ordinary-data decisions were limited to the older short list of contract, law or explicit consent.

Special-category data remains more restricted: health, ethnicity, political opinion, religion, sexual orientation, or biometric data used for unique identification.

Broader permission does not mean no protection. The organisation must provide safeguards, including:

• information about the decision;
• an opportunity to make representations;
• the ability to obtain meaningful human intervention;
• a route to contest the outcome.

General fairness, transparency, accuracy, minimisation, security and discrimination law still apply. A nominal human who just rubber-stamps the computer's answer, without real authority or review, may not count as meaningful intervention.

If an age estimate, fraud score, recruitment filter, credit decision, insurance decision, benefit process or account suspension has a serious effect on you, ask:

• Was the final decision solely automated?
• What data and principal factors were used?
• What lawful basis applies?
• Was special-category data involved?
• How can a competent human reconsider it and correct wrong inputs?

Do not bother demanding source code. The useful legal issue is meaningful information about logic, significance, consequences and safeguards.

The new complaints duty

Since 19 June 2026, organisations handling personal data must facilitate data-protection complaints, for example through an electronic complaint route. They must:

• acknowledge a complaint within 30 days;
• take appropriate steps to investigate;
• tell you the outcome without undue delay.

The 30-day acknowledgement rule applies to the complaint. It does not replace the separate time limits for a rights request.

Keep the two separate where necessary. A message can say: "This email contains (1) a subject access request for the listed data and (2) a complaint that the organisation disclosed my address without a lawful basis." That stops an organisation treating a request for records as mere grumbling, or treating a complaint as settled because it sent you a data copy.

An effective complaint identifies:

• the organisation, and your account or reference;
• the event and date;
• the personal data involved;
• why the handling appears wrong;
• the harm or risk;
• previous contact;
• the remedy you want.

Remedies might include correction, deletion where applicable, restriction, an explanation, restored access, a human review, improved security, notification to recipients, or confirmation of a changed process.

Age and identity checks

An age-assurance or digital-identity provider is still subject to data-protection law. Useful questions to ask:

• Who is the controller, and what is the purpose and lawful basis?
• Which fields are collected, and from what source?
• Who are the recipients, what is the retention period, and are there international transfers?
• Is a biometric template created? Does the data train a model?
• Does the relying service get your identity or only an age attribute?
• How do you appeal a false result?

Data minimisation matters particularly here. The ICO says that in many cases viewing an official identity document may be excessive where a method processing less information can achieve the required confidence.

A verifier should not reuse age-check data for advertising or an incompatible purpose. Accuracy and equality matter too: facial age estimation can perform unevenly, and an error may deny access to an adult.

If a provider says it deletes the image immediately, an access request may reveal little, because deleted data cannot be supplied. You can still ask for:

• transaction metadata;
• the decision result;
• confidence or age band, where held;
• recipients and retention policy;
• evidence of any human review.

Do not send another passport copy in an ordinary email unless proportionate identity verification genuinely requires it and a secure route is provided.

Making an effective request

Work through these in order:

• Identify the outcome: copy, correction, deletion, stopped marketing, restricted use, portability, human review, or complaint resolution.
• Write to the privacy contact or any clear organisational contact. Keep a copy and delivery evidence.
• Give enough to locate the record: name used, account, relevant email or phone, dates and transaction. Do not volunteer unrelated identity data.
• Name the right, but describe the substance. A request is not invalid just because the legal label is imperfect.
• Ask for secure delivery. A large unencrypted email attachment can create a fresh breach.
• Keep a log: the response deadline, clarification pauses, extension notice and every reply.
• If refused, ask for the exemption or reason relied on, the balancing assessment where relevant, and information about ICO and court remedies.

A concise access request might say: "Please provide my personal data relating to account X and the age-verification transaction on 2 July 2026, including the data submitted, decision and confidence data held, source, recipients, retention period, and any solely automated decision information. Please tell me promptly if you reasonably require clarification or identity evidence."

Tailor it. Do not send a generic demand for "all data everywhere" when a specific event is the real concern.

Limits and escalation

An organisation can refuse, or charge a reasonable fee, for a manifestly unfounded or excessive request, but it should explain the decision.

It may also withhold information to protect another person, legal privilege, crime prevention, regulatory functions, journalism, research or other statutory interests. Different rules apply to police and intelligence processing. A disagreement is not proof that the organisation acted unlawfully.

The escalation path:

• The organisation first, unless urgency or safety makes that inappropriate.
• The ICO, if the response is absent or unsatisfactory. It provides a complaint route and will normally want the correspondence and evidence. It is a regulator, not your lawyer, and does not award compensation.
• The courts can enforce rights and may award compensation where legal requirements are met. Limitation, costs, evidence and litigation risk make legal advice important before a claim.

Facing an immediate risk of identity theft, stalking, intimate-image abuse, financial loss or physical harm? Do not rely on a subject access request as your only action. Preserve evidence, secure accounts, contact the relevant service or bank, and use police or specialist support where appropriate.

Official sources

• ICO: how the Data (Use and Access) Act affects the public.
• ICO: complaints duty in force from 19 June 2026.
• ICO: making a data-protection complaint.
• Government commencement plan and the Data (Use and Access) Act 2025.
• ICO: age assurance and data-protection compliance.
• ICO: governance changes confirmed for 30 September 2026.