United KingdomUK GDPR Articles 12-21 and Data Protection Act 2018 Section 164A, Data Subject Rights in the United Kingdom
UK GDPR, Arts. 12-21; Data Protection Act 2018, s. 164A
In force since .
A data subject rights rule binding public and private bodies.
- Obligation class
- Data subject rights, Governance
- Audit expectation
- none
What it requires
- Confirm to a person in the United Kingdom, when they ask, whether you process their personal data, and give them access to it and the information listed in UK General Data Protection Regulation (GDPR) Article 15(1), on the basis of a reasonable and proportionate search.
- Rectify a person's inaccurate personal data and complete incomplete data when they ask, under UK GDPR Article 16.
- Erase a person's personal data without undue delay when they ask and a ground in UK GDPR Article 17(1) applies, unless an exception in Article 17(3) covers the processing.
- Restrict the processing of a person's personal data when they ask and a case in UK GDPR Article 18(1) applies.
- Give a person the personal data they provided to you in a structured, commonly used and machine-readable format, and transmit it directly to another controller where technically feasible, where the processing rests on consent or a contract and is automated, under UK GDPR Article 20.
- Stop processing a person's personal data for direct marketing when they object, and stop processing based on a public task, recognised legitimate interests or legitimate interests unless you demonstrate compelling legitimate grounds, under UK GDPR Article 21.
- Answer a rights request before the end of one month beginning with the relevant time, and extend that period by up to two further months only by notice, given within that first month, that states the reasons, under UK GDPR Articles 12 and 12A.
- Tell the person, without undue delay and before the end of the applicable time period, your reasons for not acting on a request and their right to complain to you under section 164A of the Data Protection Act 2018, to complain to the Information Commission, and to seek a judicial remedy, under UK GDPR Article 12(4).
- Acknowledge a data subject's complaint to you within 30 days of receiving it, provide a way to complain such as an electronic form, respond to the complaint without undue delay and tell the complainant the outcome, under Data Protection Act 2018 section 164A.
These lines are LexLint's reading of the law's text.
If you get it wrong
Criminal exposureNo
Private right of actionYes
Penalty structure
UK GDPR Art. 83(5)(b) puts infringements of the data subjects' rights pursuant to Articles 12 to 21 in the higher fine tier: the higher of £17,500,000 or 4% of total worldwide annual turnover of the preceding financial year.
- Rule
- Higher of
- As of
- Currency
- GBP
- Fixed cap
- 17,500,000
- Turnover percentage cap
- 4
Who enforces it
Enforcement body
Information Commission, to which the functions of the Information Commissioner under the data protection legislation were transferred on .
Settledness
- As of
- Open questions
- What search is reasonable and proportionate under Article 15(1A) for a controller that holds a large amount of information about the person?
What it makes you log
Logging duty
UK GDPR Articles 12 to 21 and section 164A of the Data Protection Act 2018 set how and when a controller answers a rights request or a complaint. They state no duty to create, keep or produce a log or record.
- Kind
- None
- As of
What this law does
UK GDPR Article 15 gives a data subject the right to obtain from the controller confirmation of whether their personal data are being processed and, where they are, access to the data. Article 15(1A), inserted by the Data (Use and Access) Act 2025, limits what a data subject is entitled to under Article 15(1) to what the controller can provide based on a reasonable and proportionate search.
Article 16 gives a data subject the right to have the controller rectify inaccurate personal data concerning them without undue delay. Article 17 gives a data subject the right to have the controller erase their personal data without undue delay where the data are no longer necessary for the purposes for which they were collected or otherwise processed, among other grounds.
Article 17(3) disapplies the erasure right to the extent that processing is necessary for exercising the right of freedom of expression and information, among other listed cases. Article 18 gives a data subject the right to obtain restriction of processing where the accuracy of the personal data is contested by the data subject, among other cases.
Article 20 gives a data subject the right to receive the personal data they have provided to a controller in a structured, commonly used and machine-readable format, where the processing rests on consent or a contract and is carried out by automated means. Article 21(1) lets a data subject object, on grounds relating to their particular situation, to processing based on point (e), (ea) or (f) of Article 6(1), and the controller must then stop unless it demonstrates compelling legitimate grounds.
Article 21 also gives a data subject the right to object at any time to processing of their personal data for direct marketing, after which the personal data may no longer be processed for that purpose. Article 12A defines the applicable time period under Article 12 as the period of one month beginning with the relevant time. A controller may extend the applicable time period under Article 12A by two further months by giving notice, where the complexity or number of requests makes it necessary.
Article 12A was inserted into the UK GDPR with effect from . Under Article 12(5) a controller may charge a reasonable fee or refuse to act where a request is manifestly unfounded or excessive, and bears the burden of demonstrating that. Section 164A of the Data Protection Act 2018 requires a controller that receives a data subject's complaint to acknowledge it within 30 days and then to respond to it without undue delay.
Section 164A was inserted by the Data (Use and Access) Act 2025 and has been in force in full since . Article 4(1)(7) defines a controller as the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.
When LexLint raises it
When your app profile says your app processes personal data or sends automated outreach.
Back to the example · Lint your app
Page updated .