United Kingdom: UK GDPR

After Brexit, the UK retained the GDPR as domestic law (the "UK GDPR"). Your rights are equivalent to those of EU residents.

Deadline: Companies must respond within 30 days. Extendable to 3 months for complex requests, with notice within the first 30 days.

Your rights

Right of access: Request a copy of your personal data and information about how it is used.
Right to erasure: Request deletion of your personal data when it is no longer needed or you withdraw consent.
Right to rectification: Request correction of inaccurate data.
Right to data portability: Receive your data in a machine-readable format.
Right to object: Object to processing for direct marketing (always succeeds) or legitimate interests.
Right to restriction: Pause processing while a dispute is resolved.

How to send a request

Use the GDPR deletion template — the UK GDPR uses the same legal framework. Find the company's privacy contact in the directory.

If they ignore you

File a complaint with the Information Commissioner's Office (ICO). The ICO investigates complaints about organisations that fail to comply with UK data protection law. You have three months from your last meaningful contact with the organisation to complain.

See our full escalation guide for what to include in your complaint.

ICO contact

Online complaint form: ico.org.uk/make-a-complaint
Phone: 0303 123 1113