The UK GDPR is the United Kingdom General Data Protection Regulation. With the Data Protection Act 2018, it makes up the UK's data protection law. It gives you rights over your personal information, such as getting a copy, having it corrected or deleted, and objecting to how it is used. You do not need a lawyer to use them.
Key points
✓You have the right to ask an organisation for copies of information about you, and to correct, delete or limit how it uses that information.
✓You do not need a lawyer to use your rights, and you should not need to spend time or money.
✓An organisation has one calendar month to respond to a request to delete your data, and can take up to an extra two months in some cases.
✓Since 19 June 2026 organisations must have a process for data protection complaints, and must acknowledge yours within 30 days.
✓You can ask a court for compensation if an organisation breaks data protection law and you suffer damage. You do not have to complain to the ICO first.
What does GDPR stand for?
GDPR stands for General Data Protection Regulation. The Data Protection Act 2018 defines the UK GDPR as Regulation (EU) 2016/679, the United Kingdom General Data Protection Regulation, as it forms part of UK law. The data protection legislation means the UK GDPR, the Data Protection Act 2018 and regulations made under them.
What rights do you have under UK GDPR?
Right
What it means
Right to be informed
To be told about the collection and use of your personal data
Right of access
To access and receive a copy of your personal data, and other supplementary information
Right to rectification
To have inaccurate personal data corrected, or completed if it is incomplete
Right to erasure
To have personal data deleted in certain circumstances
Right to restrict processing
To ask for the use of your personal data to be restricted or suppressed
Right to data portability
To get and reuse your personal data for your own purposes across different services
Right to object
To object to the processing of your personal data in certain circumstances
Rights about automated decisions
To contest a significant decision made solely by automated means, and ask for a human to review it
To get copies of your information, make a subject access request. Our subject access request guide explains how, and our guide to your credit report covers the data credit reference agencies hold.
How do you use your data rights?
You can ask the organisation yourself. You do not need a lawyer, and you should not need to spend time or money. All organisations, whatever their size, must consider your request and respond appropriately. If an organisation refuses, it should usually explain why.
You only have rights over your own personal information, not other people's, even family members. You can act on someone else's behalf if you can prove you have the authority. Information about someone who has died is no longer personal information, so the rights do not apply.
When can you ask for your data to be deleted?
The right to erasure, sometimes called the right to be forgotten, only applies when:
✓Yes: the organisation no longer needs your data for the reason it collected or used it
✓Yes: you consented to the use of your data and have withdrawn your consent
✓Yes: you have objected to the use of your data and your interests outweigh the organisation's
✓Yes: you have objected to the use of your data for direct marketing
✓Yes: the organisation collected or used your data unlawfully
✓Yes: the organisation has a legal obligation to erase your data
✓Yes: the data was collected from you as a child for an online service
You can ask verbally or in writing, to any part of the organisation. An organisation has one calendar month to respond. In certain circumstances it can take up to an extra two months, but it should tell you within one month and say why.
What are the seven principles of UK GDPR?
Article 5 of the UK GDPR sets out seven key principles that organisations must follow:
lawfulness, fairness and transparency
purpose limitation
data minimisation
accuracy
storage limitation
integrity and confidentiality (security)
accountability
What is a personal data breach?
Organisations must keep your personal information safe. A personal data breach is when your information is lost, accidentally destroyed, changed without permission, damaged, or accessed, disclosed to or kept by someone it should not have been. It can happen accidentally, deliberately, through recklessness, or in a cyber-attack.
Examples include the loss or theft of paperwork, computers or phones holding your information, and the wrong person receiving your information by mistake.
How do you make a data protection complaint?
Complain to the organisation first. Since 19 June 2026, the Data Protection Act 2018 says an organisation must make it easy to complain, for example by providing a complaint form you can fill in electronically. It must acknowledge your complaint within 30 days, then without undue delay look into it and tell you the outcome.
If you are unhappy with the organisation's response, you can complain to the Information Commissioner's Office. Its helpline is 0303 123 1113.
You do not have to complain to the ICO, or wait for it, before going to court for compensation. You can submit a claim at any time.
Can you get compensation for a data breach?
You can ask the organisation directly. If it agrees, it may pay you without a court claim. If it does not, you can ask a court to award compensation if you have suffered damage because the organisation broke data protection law. The ICO cannot award compensation. Our guide to the small claims court explains how a money claim works.
Does UK GDPR apply across the UK?
Yes. The Data Protection Act 2018 extends to England, Wales, Scotland and Northern Ireland, and the ICO points to the separate court systems for bringing a claim in England and Wales, in Scotland and in Northern Ireland. Our rights guides cover your other legal rights.