Short answer
Under UK GDPR you can ask any organisation for a copy of your personal data (a subject access request), have inaccurate data corrected, and in some cases have it erased. Organisations usually have one month to respond. If they do not, complain to them first, then to the ICO within three months.
What rights do you have over your personal data?
The UK GDPR and the Data Protection Act 2018 give you these main rights:
- to be informed about how your data is used (usually through a privacy notice)
- to access a copy of your data (a subject access request)
- to have inaccurate data corrected (rectification)
- to have data erased in some cases (the "right to be forgotten")
- to restrict or object to processing, including an absolute right to stop direct marketing
- to data portability, and rights relating to solely automated decisions with significant effects
These rights apply to organisations of any size, including employers, councils, landlords, shops and online platforms.
How do you make a subject access request?
A subject access request (SAR) can be made in writing, by email, online, by phone or in person, and does not need to use any special form or wording. Anyone can make one without a solicitor. To help the organisation find your data:
- say clearly that you are making a subject access request under the UK GDPR
- give your full name, contact details and any account, customer or employee number
- say what information you want, for example emails mentioning you between certain dates
- keep a record of when and how you sent it
A SAR is usually free. An organisation can only charge a reasonable fee, or refuse, if the request is manifestly unfounded or excessive. It may ask for proof of identity if it has genuine doubts.
How long does an organisation have to respond to a SAR?
The organisation must normally respond within one month. It can extend this by up to two further months if your request is complex or you have made several, but must tell you within the first month and explain why.
Since 5 February 2026, section 76 of the Data (Use and Access) Act 2025 sets out when the clock starts: when the organisation has your request plus any identity information or fee it is entitled to ask for. If it reasonably needs you to clarify a very broad request, it can pause ("stop the clock") until you reply.
You are entitled to information found through a reasonable and proportionate search. This rule, in section 78 of the 2025 Act, came into force on 19 June 2025 and is treated as applying since 1 January 2024.
When can you use the right to be forgotten?
You can ask for your data to be erased where, for example, it is no longer needed for the reason it was collected, you withdraw consent, you successfully object to its use, it was used unlawfully, or it was collected from you as a child for an online service.
The right is not absolute. An organisation can refuse where it needs the data to comply with a legal obligation, for legal claims, for public tasks, or for freedom of expression. It has one month to respond, extendable by two months in some cases.
What changed under the Data (Use and Access) Act 2025?
The Data (Use and Access) Act 2025 received Royal Assent on 19 June 2025 and amends the UK GDPR in stages. Changes now in force that matter to individuals include:
- 19 June 2025: SAR searches need only be reasonable and proportionate.
- 5 February 2026: clearer SAR time limits and the power to stop the clock for clarification; wider scope for organisations to make solely automated decisions, provided safeguards apply (you can make representations, get human review and contest the decision); new "recognised legitimate interests" such as crime prevention and safeguarding; and higher fines for breaches of the electronic marketing and cookie rules, in line with UK GDPR levels.
- 19 June 2026: every organisation must have a way for you to make a data protection complaint to it, must acknowledge your complaint within 30 days and must tell you the outcome without undue delay.
The Act also provides for the Information Commissioner's Office to be replaced by a new Information Commission.
How do you make a GDPR or ICO complaint?
Complain to the organisation first. It must now have a complaints process and acknowledge your complaint within 30 days. Keep copies of everything.
If you are unhappy with the response, you can complain to the Information Commissioner's Office (ICO). The ICO says you should do this within three months of your last meaningful contact with the organisation. The ICO can investigate and order an organisation to comply, but it cannot act as your representative or award you compensation.
Can you claim data breach compensation?
Yes, if you have suffered damage. Article 82 of the UK GDPR and section 168 of the Data Protection Act 2018 let you claim compensation from an organisation that breached data protection law for financial loss and for non-financial damage such as distress. You claim through the courts, not the ICO.
You must show the breach caused you real damage. Following the Supreme Court's decision in Lloyd v Google [2021] UKSC 50, a mere loss of control of data without proof of damage is not enough for a representative claim. Many low-value claims are dealt with in the county court small claims track. Most claims have a six-year limitation period, but take advice early as some related claims (such as defamation) have much shorter limits.
What are the key deadlines and time limits?
The main time limits are:
- Subject access request: one month from receipt of the request (and any ID needed), extendable by up to two further months
- Erasure, rectification and other rights requests: one month, extendable by up to two months
- Complaint to an organisation (for complaints received from 19 June 2026): acknowledgment within 30 days
- Complaint to the ICO: within three months of your last meaningful contact with the organisation
- Court claim for compensation: generally six years from the breach
What should you do next?
- Work out which organisation holds your data and find its privacy notice or data protection officer's contact details.
- Send a clear subject access request or rights request in writing and diary the one-month deadline.
- Ask Libra to draft your subject access request, erasure request or complaint letter and to explain the exemptions an organisation may rely on.
- If you get no reply or an unsatisfactory one, complain to the organisation using its complaints process.
- Complain to the ICO within three months of your last meaningful contact if the problem is not resolved.
- If a breach has caused you loss or distress, find a lawyer or clinic through Libra to discuss a compensation claim.
Frequently asked questions
Is there a SAR template I can use?
You do not need a template: any clear written request naming yourself, what you want and saying it is a subject access request under the UK GDPR is valid. The ICO publishes a sample letter, and Libra can draft one tailored to your situation, for example an employer or a bank.
Can an organisation charge me for a subject access request?
Usually not. Subject access requests are free. An organisation can charge a reasonable fee, based on its administrative costs, only if the request is manifestly unfounded or excessive, or for further copies of the same information. It can also refuse such requests but must explain why.
What can I do if an organisation ignores my SAR?
Send a follow-up reminding it of the one-month deadline, then complain to the organisation. If that fails, complain to the ICO within three months of your last meaningful contact. You can also apply to court for an order requiring the organisation to comply.
How much compensation can I get for a data breach?
There is no fixed tariff. Courts assess the actual financial loss and distress caused. Many claims for minor breaches with limited distress are worth relatively small sums and may be dealt with on the small claims track. Serious breaches causing financial loss or significant distress can be worth more.
Can the ICO get me compensation?
No. The ICO can investigate, issue reprimands, order an organisation to comply and impose fines, but it cannot award compensation to individuals or represent you. To get compensation you must agree it with the organisation or bring a claim in court.
Can my employer refuse a subject access request during a dispute?
Not simply because there is a dispute. Employees often use SARs during grievances or tribunal claims. An employer can withhold some information under exemptions, such as legal privilege or information about other people, and need only carry out a reasonable and proportionate search.
Can I stop a company sending me marketing emails and texts?
Yes. You can opt out at any time, and under UK GDPR you have an absolute right to object to direct marketing based on your data. Use the unsubscribe link or write to the company. Electronic marketing also needs valid consent or a qualifying existing customer relationship under the privacy and electronic communications rules, and you can complain to the ICO if it continues.
Can I get a copy of CCTV footage of myself?
Yes, footage of you is your personal data, so you can make a subject access request. Give the date, time and place so it can be found. The organisation may need to blur other people, or refuse if that is not possible. Ask quickly, as CCTV is often overwritten within weeks.
Can I ask my GP or hospital for my medical records?
Yes, through a subject access request to the practice or trust. It is free in most cases, and they should reply within one month, extendable for complex requests. Some information can be withheld, for example if disclosure would cause serious harm or reveal another person's information. You can ask for corrections of factual errors.
What should I do if a company has lost my data in a data breach?
Change passwords, turn on two-step verification, watch bank and credit files, and be alert to phishing. If the breach is likely to cause you high risk, the organisation must tell you without undue delay, and it must report serious breaches to the ICO within 72 hours. You may be able to claim compensation if you suffered damage.
Can a company make decisions about me using automated systems or AI?
Yes in more situations than before, following the Data (Use and Access) Act 2025, but safeguards apply. For significant automated decisions the organisation must tell you, let you make representations, allow you to obtain human review and let you contest the decision. Stricter rules still apply to special category data such as health.
Can I find out who a company has shared my data with?
Yes. A subject access request entitles you to a copy of your personal data and information about why it is used, where it came from, how long it will be kept, and the recipients or types of recipient it was shared with. Ask for this expressly in your request so it is not overlooked.
How long can an organisation keep my personal data?
There is no fixed period. The law requires that data is kept no longer than necessary for the purpose it was collected for, and the organisation should have a retention policy. Some records must be kept for legal reasons, such as tax records. If they no longer need your data, you can ask for it to be erased.
Ask Libra
- How do I make a subject access request to my employer?
- Draft a SAR letter to my bank
- The company has not replied to my SAR after a month, what now?
- How do I stop a company sending me marketing texts?
- How do I ask for CCTV footage of myself?
- How do I complain to the ICO about a data breach?
Sources
- ICO: Getting copies of your information (SAR)
- ICO: What to do if you do not get a response
- ICO: Your right to get your data deleted
- ICO: Data (Use and Access) Act 2025 summary of changes
- Data (Use and Access) Act 2025, section 78
- Data (Use and Access) Act 2025 (Commencement No. 6) Regulations 2026
- Data Protection Act 2018, section 168
This guide is general information about the law in England and Wales as at September 2026, not legal advice. For advice on your situation, ask Libra or find a lawyer through Libra.
.png)