Other data-protection rights

Subject access is only one UK data-protection right. This guide covers the main rights to correct, erase, restrict, move or object to the use of personal information and the usual response times.

Reviewed: September 2026UK information-rights guidance
Normal response
1 calendar month
For most rights requests.
Possible extension
Up to 2 further months
Where the request is complex or numerous.
Complaint route
Organisation → ICO
Give the controller a chance to address the issue.

Right to rectification

You can ask an organisation to correct inaccurate personal information or complete information that is incomplete. If accuracy is disputed, provide evidence and identify precisely what you say is wrong.

Right to erasure

You can ask for personal information to be erased in certain circumstances. This is sometimes called the “right to be forgotten”, but it is not an absolute right. An organisation may have a lawful reason to retain the data, for example because it is needed to comply with a legal obligation or for the establishment, exercise or defence of legal claims.

Right to restrict processing

Restriction can limit how information is used while an issue is resolved. The information can usually still be stored, but active use may need to stop in circumstances where the right applies.

Right to data portability

Portability can let you receive certain personal data in a structured, commonly used and machine-readable format or have it transferred to another controller. It applies only in defined circumstances, principally to data you provided where processing is automated and based on consent or contract.

Right to object

You can object to processing in certain circumstances. The right is absolute for direct marketing. For some other processing based on public task or legitimate interests, the organisation may continue only if it can establish a lawful basis that overcomes the objection in the circumstances.

Automated decisions and profiling

Data-protection law places safeguards around significant decisions made without meaningful human involvement. Depending on the type of automated decision and legal basis, you may have rights to receive information, express your view, seek human intervention or challenge the decision.

How the deadline works

Most individual-rights requests must be dealt with without undue delay and normally within one calendar month. If necessary identity information is requested, the response period starts when that information is received. A qualifying complex request or a number of requests from the same person can justify an extension of up to two further months, but the organisation must notify you and explain why within the initial month.

Not every right works the same way

The one-month response period does not mean the organisation must always grant what you asked for. Some rights apply only in particular circumstances, and exemptions or competing legal duties may justify refusal.

If the organisation says no

Ask for the legal basis and reasoning. If you believe the decision is wrong, make a data-protection complaint to the organisation. For complaints received on or after 19 June 2026, controllers must acknowledge the complaint within 30 days, investigate it appropriately and provide an outcome without unjustifiable or excessive delay. If you remain dissatisfied, you can complain to the ICO.

Official sources

Reviewed September 2026. This page is general information, not legal advice. For a live dispute or critical deadline, check the current ICO guidance and legislation.