ConsumerWise hub
Data & Privacy
Practical UK data-protection rights: access, accuracy, correction, deletion, restriction, complaints and evidence.
Browse this area
22 guides and resources.
Start with the problem you recognise. Related pages cross-link to templates, tools, official sources and escalation routes.
Data (Use and Access) Act 2025
Current amendments to the UK data-protection framework, including the reasonable-and-proportionate-search rule for SARs.
UK GDPR & DPA 2018
How the UK GDPR and Data Protection Act 2018 fit together and why the correct legal regime matters.
Subject Access Requests
How to ask for your personal data, what a SAR covers and how organisations should recognise one.
SAR deadlines
The one-calendar-month rule, identity checks, clarification, extensions and weekend/bank-holiday roll-forward.
SAR identity checks
When an organisation may ask for ID and why the request should be reasonable and proportionate.
SAR clarification
When clarification is genuinely needed, when the clock can pause and why an organisation cannot simply force a request to be narrowed.
SAR extensions
When a SAR may be extended by up to two further months and what the organisation must tell you.
Missing SAR data
Forensically test missing emails, calls, Teams/Slack, notes, archives, backups, personal devices, deletions and search methodology.
SAR exemptions
How exemptions and restrictions work, and why a refusal should be tied to a recognisable legal basis.
Challenging a SAR response
Turn search gaps, redactions, exemptions, Article 15 omissions and deadline failures into a structured complaint and ICO-ready challenge.
Right to rectification
Correcting inaccurate personal data and completing incomplete data where appropriate.
Right to erasure
When deletion can be requested, when it is not absolute and how erasure differs from rectification.
Restriction of processing
Freezing use of disputed data in defined circumstances while accuracy or lawfulness is examined.
Right to object
Objecting to certain processing and understanding when an organisation may continue despite the objection.
Data portability
Receiving certain data in a structured, commonly used and machine-readable format.
Automated decisions & profiling
Rights and safeguards around solely automated decisions with significant effects.
Data accuracy
The accuracy principle, source/status of data and how to challenge records that do not reliably reflect reality.
Data breaches
What a personal-data breach is, what organisations should assess and when individuals may need to be told.
Complaining to an organisation
How to complain about data protection before escalating to the ICO.
Complaining to the ICO
How to present a focused ICO complaint with the request, response, disputed issues and supporting records.
Employment data
SARs, HR files, emails, disciplinary material and the complications created by third-party data and privilege.
Credit-file data
How data-protection accuracy rights interact with lender/CRA dispute routes and credit-reporting standards.
ConsumerWise method
Do not start with the argument. Start with the record.
Data rights are practical rights. Identify the personal data or processing activity in issue, use the correct right, keep the request and response dates, and escalate only the part that remains unresolved. Access, accuracy, erasure and objection are different tools.
Evidence basics Build a chronology