Other data-protection rights
Subject access is only one UK data-protection right. This guide covers the main rights to correct, erase, restrict, move or object to the use of personal information and the usual response times.
Right to rectification
You can ask an organisation to correct inaccurate personal information or complete information that is incomplete. If accuracy is disputed, provide evidence and identify precisely what you say is wrong.
Right to erasure
You can ask for personal information to be erased in certain circumstances. This is sometimes called the “right to be forgotten”, but it is not an absolute right. An organisation may have a lawful reason to retain the data, for example because it is needed to comply with a legal obligation or for the establishment, exercise or defence of legal claims.
Right to restrict processing
Restriction can limit how information is used while an issue is resolved. The information can usually still be stored, but active use may need to stop in circumstances where the right applies.
Right to data portability
Portability can let you receive certain personal data in a structured, commonly used and machine-readable format or have it transferred to another controller. It applies only in defined circumstances, principally to data you provided where processing is automated and based on consent or contract.
Right to object
You can object to processing in certain circumstances. The right is absolute for direct marketing. For some other processing based on public task or legitimate interests, the organisation may continue only if it can establish a lawful basis that overcomes the objection in the circumstances.
Automated decisions and profiling
Data-protection law places safeguards around significant decisions made without meaningful human involvement. Depending on the type of automated decision and legal basis, you may have rights to receive information, express your view, seek human intervention or challenge the decision.
How the deadline works
Most individual-rights requests must be dealt with without undue delay and normally within one calendar month. If necessary identity information is requested, the response period starts when that information is received. A qualifying complex request or a number of requests from the same person can justify an extension of up to two further months, but the organisation must notify you and explain why within the initial month.
The one-month response period does not mean the organisation must always grant what you asked for. Some rights apply only in particular circumstances, and exemptions or competing legal duties may justify refusal.
If the organisation says no
Ask for the legal basis and reasoning. If you believe the decision is wrong, make a data-protection complaint to the organisation. For complaints received on or after 19 June 2026, controllers must acknowledge the complaint within 30 days, investigate it appropriately and provide an outcome without unjustifiable or excessive delay. If you remain dissatisfied, you can complain to the ICO.
Official sources
- ICO – A guide to individual rights
- ICO – Right to erasure
- ICO – Right to object (updated July 2026)
- ICO – Data-protection complaint guidance
- Data Protection Act 2018
Reviewed September 2026. This page is general information, not legal advice. For a live dispute or critical deadline, check the current ICO guidance and legislation.