UK GDPR — practical summary
The parts of the UK GDPR most relevant to personal-data rights and response deadlines, read together with the Data Protection Act 2018 and the DUAA amendments.
What the UK GDPR does
The UK GDPR is a central part of the UK's data-protection framework. It governs how personal data is processed and gives individuals a set of enforceable rights. The Data Protection Act 2018 supplements it, and the Data (Use and Access) Act 2025 has amended parts of the framework.
Core individual rights
- Right to be informed.
- Right of access (SAR).
- Right to rectification.
- Right to erasure.
- Right to restrict processing.
- Right to data portability.
- Right to object.
- Safeguards and rights relating to automated decision-making and profiling.
Response timing
Most rights requests must be dealt with without undue delay and within one calendar month, subject to the rules on necessary identity information and qualifying extensions. Topic-specific rights can have their own scope, conditions and exceptions.
Principles still matter
The law's principles include lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; and accountability. Rights requests often expose underlying questions about those principles, but a SAR is specifically an access right rather than a general mechanism for deciding every data-protection complaint.
Official sources
- ICO – Guide to individual rights
- ICO – A guide to subject access
- Data Protection Act 2018
- Data (Use and Access) Act 2025
Reviewed September 2026. This page is general information, not legal advice. For a live dispute or critical deadline, check the current ICO guidance and legislation.