--- title: "United Kingdom — Data Subject Rights | Data Protection Monitor" canonical: https://dataprotection.gi/jurisdictions/united-kingdom/data-subject-rights/ source_html: /jurisdictions/united-kingdom/data-subject-rights/index.html description: "United Kingdom — Data Subject Rights (Green, 5 sub-modules, 4 claims): Core rights framework unchanged; DUAA amendments are procedural clarifications rather than reductions in substantive rights." generated_at: 2026-10-25T04:46:50Z content_sha256: 23a11c523431a5b4e80f585c4fcc6cdac07237566f8636f4623170d3b03c418d generator: "fe-fleet/md-twin@1.0" --- # United Kingdom — Data Subject Rights | Data Protection Monitor ### D3Data Subject Rights5 sub-modules4 claimsGreen▾# Core rights framework unchanged; DUAA amendments are procedural clarifications rather than reductions in substantive rights. Primary framework UK GDPR Articles 12-22; DPA 2018 Part 2 Supervisory authority [Information Commissioner's Office (ICO)](https://ico.org.uk/) Traffic-light rationale — Green Core rights framework unchanged; DUAA amendments are procedural clarifications rather than reductions in substantive rights. #### Sub-modules (5) #### Rectification And ErasureAmber Rectification and erasure rights under UK GDPR Articles 16-17 are unaffected in substance by the DUAA; no dedicated new instrument was located for this sub-module beyond the general 'no material change' framing in ICO's DUAA summary. Claims (1): - Most DUAA changes offer organisations optional flexibility rather than mandating specific changes to existing rectification/erasure obligations, meaning the substantive right to rectification and erasure is not materially altered. #### Restriction And ObjectionGreen Individuals retain an absolute right to object to processing for direct marketing purposes at any time, with a qualified right to object in other circumstances (e.g., public task, legitimate interests, research). Claims (1): - Individuals have an absolute right under UK GDPR Article 21 to stop their personal data being used for direct marketing, and controllers must inform individuals of this right at the latest at first communication. #### Data PortabilityAmber No DUAA-specific change to the Article 20 data portability right was identified in this research pass; the underlying UK GDPR Article 20 portability right is presumed to continue unamended, but this was not separately confirmed against a primary source in this run. Category narrative 179 words Chapter III UK GDPR provides rights to be informed (Arts. 13–14, with DUAA s.77 broadening the Art. 14 disproportionate-effort exemption for research from 5 February 2026), access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), and objection (Art. 21, absolute for direct marketing under Art. 21(2)–(3)). DUAA 2025 s.76 and s.78 (in force 5 February 2026 via SI 2026/82) codify ICO case law on DSARs in Art. 15 UK GDPR: controllers are required only to conduct a 'reasonable and proportionate search', and statutory 'stop-the-clock' rules pause the one-month response window while the controller awaits reasonably required identity verification or scope clarification on a voluminous request. From 19 June 2026 (DUAA s.103 inserting s.164A DPA 2018, commenced by SI 2026/82), every controller must maintain an accessible internal data protection complaints procedure (including an electronic submission form), acknowledge complaints within 30 days of receipt, investigate and notify the outcome without undue delay, and data subjects must generally exhaust the controller's internal complaint process before the ICO is obliged to investigate under s.165 DPA 2018. Evidence 4 Sources and claims (4) - Confirmed[Information Commissioner's Office](https://ico.org.uk/about-the-ico/what-we-do/legislation-we-cover/data-use-and-access-act-2025/the-data-use-and-access-act-2025-duaa-summary-of-the-changes/data-protection/) — The DUAA 2025 inserts provisions into UK GDPR and DPA 2018 Part 3 allowing controllers to pause ('stop the clock') the SAR response time limit in order to request reasonably required clarification from the requester.observed 2026-07-28 - Probable[Information Commissioner's Office](https://ico.org.uk/about-the-ico/what-we-do/legislation-we-cover/data-use-and-access-act-2025/the-data-use-and-access-act-2025-what-does-it-mean-for-organisations/) — Most DUAA changes offer organisations optional flexibility rather than mandating specific changes to existing rectification/erasure obligations, meaning the substantive right to rectification and erasure is not materially altered.observed 2026-07-28 - Confirmed[Information Commissioner's Office](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/individual-rights/right-to-object/) — Individuals have an absolute right under UK GDPR Article 21 to stop their personal data being used for direct marketing, and controllers must inform individuals of this right at the latest at first communication.observed 2026-07-28 - Confirmed[Information Commissioner's Office](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/individual-rights/right-to-object/) — Controllers have one calendar month to respond to a right-to-object request under UK GDPR.observed 2026-07-28