Data Protection Monitor
Global Privacy & Data Protection Intelligence

United Kingdom (UK) · Module Detail

United Kingdom: Data Subject Rights

← Full United Kingdom overview Build report with United Kingdom Request deeper dive

#

Core rights framework unchanged; DUAA amendments are procedural clarifications rather than reductions in substantive rights.

Primary frameworkUK GDPR Articles 12-22; DPA 2018 Part 2
Supervisory authorityInformation Commissioner's Office (ICO)
Traffic-light rationale — GreenCore rights framework unchanged; DUAA amendments are procedural clarifications rather than reductions in substantive rights.

Sub-modules (5)

Rectification And ErasureAmber

Rectification and erasure rights under UK GDPR Articles 16-17 are unaffected in substance by the DUAA; no dedicated new instrument was located for this sub-module beyond the general 'no material change' framing in ICO's DUAA summary.

Claims (1):

  • Most DUAA changes offer organisations optional flexibility rather than mandating specific changes to existing rectification/erasure obligations, meaning the substantive right to rectification and erasure is not materially altered.

Restriction And ObjectionGreen

Individuals retain an absolute right to object to processing for direct marketing purposes at any time, with a qualified right to object in other circumstances (e.g., public task, legitimate interests, research).

Claims (1):

  • Individuals have an absolute right under UK GDPR Article 21 to stop their personal data being used for direct marketing, and controllers must inform individuals of this right at the latest at first communication.

Data PortabilityAmber

No DUAA-specific change to the Article 20 data portability right was identified in this research pass; the underlying UK GDPR Article 20 portability right is presumed to continue unamended, but this was not separately confirmed against a primary source in this run.

Category narrative179 words

Chapter III UK GDPR provides rights to be informed (Arts. 13–14, with DUAA s.77 broadening the Art. 14 disproportionate-effort exemption for research from 5 February 2026), access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), and objection (Art. 21, absolute for direct marketing under Art. 21(2)–(3)). DUAA 2025 s.76 and s.78 (in force 5 February 2026 via SI 2026/82) codify ICO case law on DSARs in Art. 15 UK GDPR: controllers are required only to conduct a 'reasonable and proportionate search', and statutory 'stop-the-clock' rules pause the one-month response window while the controller awaits reasonably required identity verification or scope clarification on a voluminous request. From 19 June 2026 (DUAA s.103 inserting s.164A DPA 2018, commenced by SI 2026/82), every controller must maintain an accessible internal data protection complaints procedure (including an electronic submission form), acknowledge complaints within 30 days of receipt, investigate and notify the outcome without undue delay, and data subjects must generally exhaust the controller's internal complaint process before the ICO is obliged to investigate under s.165 DPA 2018.

Sources and claims (4)
  1. ConfirmedInformation Commissioner's Office — The DUAA 2025 inserts provisions into UK GDPR and DPA 2018 Part 3 allowing controllers to pause ('stop the clock') the SAR response time limit in order to request reasonably required clarification from the requester.observed
  2. ProbableInformation Commissioner's Office — Most DUAA changes offer organisations optional flexibility rather than mandating specific changes to existing rectification/erasure obligations, meaning the substantive right to rectification and erasure is not materially altered.observed
  3. ConfirmedInformation Commissioner's Office — Individuals have an absolute right under UK GDPR Article 21 to stop their personal data being used for direct marketing, and controllers must inform individuals of this right at the latest at first communication.observed
  4. ConfirmedInformation Commissioner's Office — Controllers have one calendar month to respond to a right-to-object request under UK GDPR.observed