Home Data Subject Rights

Data Subject Rights

Data protection laws are designed to make sure that an individual’s personal data is protected and used legally. Individuals will inevitably provide organisations with their personal data, such as name and address, when they interact and transact with organisations.

It is important that individuals understand their personal data rights so they can enforce those rights if need be.

Right to be informed

An organisation is required to inform an individual if it is using their personal data at the time it collects the data. This includes why it is using an individual’s personal data, the type of data being collected, how long the data will be kept and whether the data will be shared with third parties.

Organisations commonly provide privacy information in a privacy notice, such as a website privacy policy.

Other information that should be provided includes an individual’s information rights (including its right to complain to the Information Commissioner’s Officer (ICO)) and details of how to contact the organisation.

Subject access request

An individual has the right to ask an organisation whether or not they are using or storing their personal information. This is commonly known as making a subject access request.

Such a request can be made verbally or in writing and can include asking for copies of the personal data.

A subject access request can be used by an individual to not only find out about what personal information an organisation holds about them, but how the organisation use the data, who they share it with and where they got the data from.

Right to correct data

If the accuracy of personal data held by an organisation is inaccurate, an individual can ask for their data to be corrected or deleted. This is known as the ‘right to rectification’. An individual can also ask an organisation to complete any incomplete data by adding more details.

The right to rectification links to the principle that personal data should be accurate. Organisations are required to take reasonable steps to ensure the accuracy of personal data and carefully consider any challenges to the accuracy of data.

Right to erasure

Individuals have a right to ask organisations that hold their personal data to delete it. This is sometimes referred to as the ‘right to be forgotten’.

However, organisations are only required to delete such personal data in the following circumstances:

  • the organisation no longer needs the data for the original reason they collected or used it for.
  • the individual initially consented to the organisation using their data, but have now withdrawn their consent.
  • the individual has objected to the use of their data, and their interests outweigh those of the organisation using it.
  • the individual has objected to the use of their data for direct marketing purposes.
  • the organisation has collected or used the data unlawfully.
  • the organisation has a legal obligation to erase the data.
  • the data was collected from a child for an online service.

Right to restriction

Individuals can limit the way an organisation uses their personal data if they are concerned about the accuracy of the data or how it is being used. For instance, an individual may wish to ask an organisation to temporarily limit the use of their data whilst the organisation is considering a challenge made to the accuracy of the data.

In such circumstances, the organisation must take appropriate steps to restrict the use of the personal data.

Right to object to the use of data

In certain circumstances, an individual has the right to object to an organisation processing (using) their personal data at any time. This effectively means stopping or preventing the organisation from using the data.

An individual can only object to processing when the organisation is using data:

  • for direct marketing purposes;
  • for a task carried out in the public interest;
  • for the exercise of official authority;
  • for their legitimate interests; or
  • for scientific or historical research, or statistical purposes.

If an objection is successful, the organisation must stop or not begin processing personal data for that use. However, an organisation may still be able to legitimately continue using data for other purposes.

For direct marketing purposes, if an objection is raised then the organisation must stop using the data for these purposes and an organisation cannot refuse such an objection.

For purposes other than direct marketing, an organisation may refuse to comply with an objection but only if they can provide strong and legitimate reasons to continue using the data.

Data protection law also contains exemptions. If an exemption applies, the organisation can either fully or partly refuse to comply with a request.

Right to data portability

An individual has the right to get their personal data from an organisation in a way that is accessible and machine-readable, for example as a csv file.

An individual may also request that their personal data be transferred to another organisation. Organisations are only required to do this if the transfer is “technically feasible”.

When can organisations refuse requests

If an organisation believes that a request by an individual is “manifestly unfounded or excessive”, it can:

  • request a reasonable fee to deal with the request, or
  • refuse to deal with the request.

In reaching this decision, the organisation can take into account whether the request is repetitive. However, the organisation must inform the individual of its decision and be able to justify it.

Also, some rights are subject to specific exemptions, which if applicable, may mean that an organisation can either fully or partly refuse to comply with a request.

Time limits for organisations

An organisation has one month to respond to an individual’s request to exercise one of its data protection rights. In certain circumstances, an organisation may need extra time to consider a request and can take up to an extra two months. If an organisation requires more time, it should let the individual know within one month and explain the reasons why.

If you need any advice on data subject rights, please contact a member of our team in confidence here or on 02920 829 100 for a free initial call to see how they can help.


Contact Our Team

To speak to one of our experts today, please contact us on 02920 829 100 or by using our Contact Us form for a free initial chat to see how we can help.

Emily Shingler
Associate
View Profile
Fflur Jones
Managing Partner
View Profile
Owen John
Partner
View Profile
Rachel Ford-Evans
Senior Associate
View Profile
Rich Craven
Solicitor
View Profile
Siobhan Williams
Senior Associate
View Profile
Stephen Thompson
Partner
View Profile

What our clients have said...