Your Data Protection Rights

The UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 give individuals a set of rights over their personal data. These data protection rights apply to the data any organisation holds about you — your employer, your bank, the NHS, a retailer, a landlord, or a website like this one.

This page explains each of the individual rights under UK GDPR in plain English, and how to exercise them. Because GetMySAR also holds some personal data about its own users, the final sections explain how the same rights apply to us.

For the right most people use — getting a copy of your data — see also our What Is a SAR and UK GDPR pages.

A data subject is the person the personal data is about. If a company holds your name, contact details, account history or opinions about you, you are the data subject for that data — the law is written from your point of view, and the rights on this page are often called data subject rights.

The organisation that decides how and why your data is used is the data controller. Your rights are exercised against the controller, and it is the controller that must respond.

UK GDPR gives you, as a data subject, eight individual rights:

• the right to be informed about how your data is used
• the right of access — to get a copy of your data
• the right to rectification — to correct inaccurate data
• the right to erasure — often called the right to be forgotten
• the right to restrict processing
• the right to data portability
• the right to object to certain uses of your data
• rights around automated decision-making and profiling

None of these rights is absolute — each applies in some circumstances and not others, and some carry exemptions. The sections below explain what each right means and when it is likely to help.

Organisations must tell you, in clear language, what personal data they collect, why, on what lawful basis, how long they keep it, and who they share it with. This is usually done in a privacy notice — the document most websites link in their footer.

If you cannot find this information, or it does not answer your question, that is often a good reason to use the right of access below.

The right of access, set out in Article 15 UK GDPR, lets you ask any organisation for a copy of the personal data it holds about you, together with information about how it is being used. You exercise it by making a Subject Access Request (SAR) — the request this site exists to help with.

A SAR can recover your file from an employer, emails that mention you, call recordings, notes on your account, CCTV and more. Our What Is a SAR page explains what you can get, and you can generate a SAR letter for free or have GetMySAR prepare and send the request for you.

An organisation must respond without undue delay and within one month. It may extend by up to two further months where the request is complex or you have made a number of requests, but it must tell you within the first month that it is doing so, and why.

If an organisation holds personal data about you that is inaccurate or incomplete, you have the right to ask it to correct or complete that data. This matters most where a wrong record follows you around — an incorrect address or date of birth, a wrongly recorded incident, or an error in a medical or employment file.

Many people make a subject access request first, to see exactly what is recorded, and then ask for rectification of anything that is wrong.

The right to erasure — widely known as the right to be forgotten — lets you ask an organisation to delete personal data it holds about you. It applies in some circumstances: for example, where the data is no longer needed for the purpose it was collected for, where you withdraw consent and no other lawful basis applies, or where the data has been used unlawfully.

It is not absolute. An organisation can refuse where it still has a lawful reason to keep the data — a legal obligation, a live contract, or the defence of legal claims are common examples.

If you are considering asking for deletion, it is usually worth getting a copy of your data first with a subject access request — once data is erased, you cannot see what it said.

For the full picture — every ground for erasure, when an organisation can refuse, and how to word the request — see our guide to the right to be forgotten.

In some situations you can ask an organisation to limit what it does with your data while a question is resolved — for example, while it checks the accuracy of data you have disputed, or while it considers an objection you have raised. The organisation can go on storing the data, but must stop otherwise using it.

For data you provided to an organisation, processed by automated means on the basis of your consent or a contract, you can ask to receive it in a structured, commonly used, machine-readable format — or ask for it to be sent directly to another provider. It is designed for switching services: moving your data between banks, energy suppliers or platforms.

You can object to an organisation processing your personal data in certain cases — most importantly where it relies on its own legitimate interests, and always where your data is used for direct marketing. An objection to direct marketing is absolute: the organisation must stop.

Where a decision with legal or similarly significant effects is made about you solely by automated means — a credit decision, for example — you have safeguards: the right to be told it is happening, to ask for a human to review the decision, and to contest it.

A subject access request is also how you find out what a profile or automated system has recorded about you in the first place.

You exercise any of these rights by asking the organisation — the data controller — directly. A request does not need to use legal wording or name the right, but a clear written request is easier to enforce later. For access requests, our free letter tool produces a properly-worded SAR in a few minutes.

There is normally no fee. A reasonable fee may only be charged where a request is manifestly unfounded or excessive, or where you ask for further copies.

An organisation may ask you to verify your identity, but only where it has reasonable doubts about who you are, and it should ask for the minimum needed. Where it needs further information to deal with your request, the one-month clock pauses until you provide it.

If the organisation does not respond properly: Complain to the organisation first. Since 19 June 2026 every organisation has had a legal duty to give you a clear way to raise a data protection complaint, to acknowledge it within 30 days, to look into it properly and to tell you the outcome. If it does not, or the answer is incomplete, you can then complain to the Information Commissioner's Office.

Everything above applies to GetMySAR too, for the personal data we hold about you as a user of this site — your account details, the requests you have prepared, and correspondence with us. Our Privacy Policy and Data Protection pages describe that data in detail.

One important distinction: GetMySAR helps you prepare and send SARs, but the organisation you send a request to holds its own records about you. If your request is about the data in that organisation’s records, the organisation — not GetMySAR — is the controller that must respond.

Where we rely on your consent to process personal data, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

As with any organisation, these rights are not unlimited: whether one applies depends on the circumstances, the type of data and the legal basis for the processing, and we may need to keep certain information where we have a lawful reason to do so.

To exercise any of your rights in relation to personal data held by GetMySAR, please use our contact form. Provide enough information for us to understand your request and confirm your identity where necessary.

We aim to acknowledge rights requests within 3 days. Where data protection law requires a substantive response, this will usually be provided within one month, subject to any lawful extension.

If you are unhappy with how we have handled your personal data or your rights request, please contact us first using our contact form.

You also have the right to complain to the Information Commissioner's Office (ICO).

ICO website: https://ico.org.uk/make-a-complaint/