Recognise the right being exercised, calculate the deadline, find the relevant data, apply any restriction to the specific material, and give the person a clear, secure response.
Use this guide for implementation planning, not as a substitute for checking the consolidated UK GDPR, applicable Data Protection Act 2018 provisions, current ICO guidance, contracts, and the facts of the processing.
People can exercise access, rectification, erasure, restriction, portability, objection, and automated-decision rights, but each right has different conditions and limits. A request can be verbal or written and does not need to mention the UK GDPR. Respond without undue delay and normally within one month. Since 5 February 2026, sets the start date when reasonably requested identity information or a permitted fee is outstanding; clarification can pause the access-request clock only where it is reasonably required to identify the requested information.
Identify which right is being exercised rather than treating every contact as a subject access request. Record receipt, identity and authority, the relevant time under , the processing and systems in scope, and any applicable exemption or restriction.
For access, the controller must make a reasonable and proportionate search. It must be able to explain why any further search would be unreasonable or disproportionate, and must still search the other information within scope. Record systems, custodians, search terms, date ranges, repositories, third-party data, redactions, and review.
Respond without undue delay and before the applicable period ends. A further two months is available where necessary because the request is complex or the person has made a number of requests. Tell the person within the first month and explain the reason for the extension.
Sources (2)
Current ICO guidance on recognising access requests, the one-month period, extensions, fees, searches, disclosure, and refusals.
Binding Articles 12, 12A, and 15 to 22 governing response procedure and individual rights.
Access provides confirmation, a copy of the person's personal data, and supplementary information. Rectification covers inaccurate data and completion of incomplete data. Erasure applies only in specified circumstances, including where data is no longer needed, consent is withdrawn with no other basis, a valid objection succeeds, or processing is unlawful; legal obligations, freedom of expression, public-interest tasks, research safeguards, and legal claims can limit it.
Restriction applies in specified cases, including while accuracy or an objection is checked. Portability covers data the person provided where processing is based on consent or contract and carried out by automated means. Objection applies to public-task, recognised-legitimate-interest, and ordinary-legitimate-interest processing, with an absolute right to stop direct marketing.
Articles 22A to 22C govern a decision with no meaningful human involvement that produces a legal or similarly significant effect. The controller must tell the person about the decision and enable representations, human intervention, and a challenge. Solely automated significant decisions using face the additional Article 22B conditions, and a controller cannot make one where the decision processing relies wholly or partly on recognised legitimate interest.
Sources (2)
ICO guidance on access, rectification, erasure, restriction, portability, objection, and automated decision-making.
Binding Articles 15 to 22 and Article 19 notification duties.
Route each request by right, calculate the Article 12A clock, record searches and exemptions, carry the outcome through every relevant system, and keep a defensible response file.
Create rights-intake questions, deadline fields, search tasks, and response checks.
Use Research Copilot to answer follow-up questions with cited source material.
Review scope, evidence, owners, and the next compliance actions with Sorena.
A controller may refuse to act on a request, or charge a reasonable fee where permitted, but it bears the burden of showing why. Repetition alone is not automatically excessive. Consider the request's context, overlap, interval, purpose, burden, and whether the person is exercising a fundamental right.
The Data Protection Act 2018 contains exemptions for particular data, purposes, and circumstances, including some third-party information, legal professional privilege, management forecasting, negotiations, regulatory functions, journalism, research, and crime or taxation. Apply the precise provision to the precise material. An exemption may limit only part of the response.
Sources (2)
Binding UK exemptions and restrictions that may qualify individual rights.
ICO guidance on manifestly unfounded or excessive requests, third-party information, exemptions, and refusal notices.
Use one intake channel and deadline record, but route the substance to the system and business owners who can search, correct, delete, restrict, export, or stop the processing. The controller remains accountable when a processor performs searches or technical changes.
Keep the original request, receipt date, identity or authority check, calculation, clarification and pause dates, search plan and results, decisions by right, exemption and third-party analysis, copies or descriptions of disclosed material, secure delivery evidence, recipient notifications, correspondence, approver, and closure date.
A rights request and a data protection complaint are separate even when one message contains both. Record and answer the right within , and also use the organisation's complaint process. Give people a way to complain, acknowledge receipt within 30 days, make appropriate enquiries, keep them informed, and communicate the outcome without undue delay.
Sources (4)
ICO operational guidance and checklists for preparing for and responding to each right.
Binding response, identity, fee, timing, transparency, and controller-accountability requirements.
Current ICO summary of the separate data-protection complaint channel, 30-day acknowledgement, and response duty.
Current operational guidance for handling a complaint separately from any rights request in the same communication.
Decide whether a UK personal data breach must be reported to the ICO, when the 72-hour clock starts, what the report must contain, and when individuals must be told.
Use UK transfer approval regulations by checking the destination, recipient, data, sector, effective status, scope limits, and review evidence.
Current UK GDPR rules for significant solely automated decisions, meaningful human involvement, Article 22B restrictions, and Article 22C safeguards.
Apply the UK GDPR material and territorial scope tests to one processing activity, including exclusions, non-UK organisations, roles, and evidence.
Build UK GDPR Article 30 records for controller and processor activities, apply the narrow under-250 exception, and keep the records current and available to the ICO.
Decide whether a personal data breach must be reported to the ICO or communicated to individuals, with deadlines, exceptions, content, and evidence.
Run a UK GDPR personal data breach workflow from containment and awareness through risk assessment, ICO reporting, individual notice, and the breach record.
Apply UK GDPR children's protections and the Age Appropriate Design Code to online services likely to be accessed by children.
A practical guide to Children's Code scope, its 15 standards, age 13 consent, evidence, exceptions, and product implementation.
A verifiable UK GDPR checklist for scope, lawful processing, transparency, rights, governance, security, breaches, DPIAs, children, and transfers.
Answer common UK GDPR questions on scope, lawful basis, records, DPIAs, DPOs, rights, breaches, children, automated decisions, and international transfers.
Build a UK GDPR compliance programme around processing records, lawful decisions, rights operations, security, incidents, DPIAs, suppliers, and transfers.
Decide whether each party is a controller, joint controller, or processor under the UK GDPR, then record the role-specific duties, contract terms, and evidence.
Track UK GDPR deadlines for rights requests, privacy information, breach notification, DPIAs, and ICO prior consultation, with triggers and exceptions.
Screen UK GDPR processing for likely high risk, complete the required DPIA analysis before processing, reduce risk, and consult the ICO when high residual risk remains.
Decide when the UK GDPR requires a DPIA or DPO, what each must cover, when to consult the ICO, and what evidence to retain.
Run a UK subject-access workflow using the current Article 12A clock, reasonable identity and clarification steps, proportionate searches, exemptions, redactions, and response evidence.
Choose the UK IDTA or Addendum, complete the current Article 46 data protection test, add needed measures, and maintain evidence for restricted transfers.
Choose among the six familiar Article 6 bases and the UK's recognised legitimate interests basis, then document any Article 9 or 10 condition.
UK GDPR and PECR cookie guidance with practical consent, exemption, evidence, and cited implementation decisions.
Understand the UK GDPR £8.7 million or 2% and £17.5 million or 4% fine ceilings, which infringements fall into each band, and how the ICO sets a fine.
Map UK GDPR requirements by processing activity, role, lawful basis, data type, risk, rights, suppliers, automated decisions, and transfers.
Apply the UK GDPR restricted-transfer sequence: map the transfer, check Article 45A approval, choose an Article 46 safeguard and assessment, or justify a specific Article 49 derogation.
Decide whether a UK restricted transfer exists, whether adequacy applies, how to use the IDTA or UK Addendum, and how to document the data protection test.
See when to use the UK GDPR, when the Data Protection Act 2018 adds a condition or exemption, and which regime covers law enforcement or intelligence processing.
Determine whether UK GDPR, EU GDPR, or both apply, then separate representatives, regulators, transfer routes, national law, and post-Brexit UK amendments.
Choose between the UK IDTA and EU SCCs with the UK Addendum, complete the right documents, and record the separate UK and EU transfer assessments.
Compare current UK and EU rules for recognised legitimate interests, rights requests, access searches, automated decisions, and international transfers.
Configure separate UK and EU privacy operations for representatives, regulator contacts, rights requests, breach reporting, transfer tools, and evidence.
Choose and document the UK GDPR lawful basis that fits each processing purpose, including recognised legitimate interest, in force since 5 February 2026.
Decide whether an online service is likely to be accessed by UK children and apply the ICO Children's Code standards to product design and personal-data use.
Decide whether a personal data breach must be reported to the ICO, when the 72-hour clock starts, what the report needs, and when affected people must be told.
Check whether current UK adequacy regulations cover a restricted transfer, including partial coverage for Canada, Japan, and the US UK Extension.
Apply the current UK rules for significant solely automated decisions, special-category restrictions, meaningful human involvement, and Article 22C safeguards.
See which controllers and processors need records of processing activities, what each record must contain, and how the under-250-employee exemption works.
Decide whether each party is a controller, joint controller, processor, or sub-processor, then record the contracts, responsibilities, and evidence the role requires.
Screen for likely high-risk processing, complete the Article 35 assessment before processing, and consult the ICO if high residual risk remains.
Apply the three UK GDPR DPO triggers and document expertise, independence, reporting line, resources, tasks, contacts, and conflict controls.
Decide when to use the UK IDTA or Addendum, complete the Article 46 data protection test, add supplementary measures, and keep the transfer under review.
Apply the current UK PECR rules to cookies and similar technologies, including consent, five exceptions, UK GDPR overlap, and evidence.