Public authorities are also data controllers: UK GDPR and DPA 2018 rights can apply alongside FOI, EIR and public-law complaint routes.
If a council, NHS body or government agency holds personal data about you, rights such as access, rectification, restriction, objection and complaint to the ICO can apply. The public nature of the organisation does not remove data-protection duties.
The key is choosing the right route: your own personal data is usually a SAR; general recorded public information may be FOI; environmental information may be EIR.
Key points
- SAR and FOI are different rights with different deadlines.
- Public authorities may rely on public-task legal bases rather than consent.
- Factual inaccuracy and disagreement with an official/professional opinion are different issues.
- Complaint and statutory appeal routes can run alongside data rights.
Access
Use a SAR for your personal data: case notes, emails about you, call recordings, audit trails and other personal-data content where held and within scope.
Rectification and accuracy
Ask for objectively inaccurate facts to be corrected. If the authority records a disputed opinion, it may be more appropriate to ensure the record accurately reflects the opinion and your challenge rather than demand deletion of the opinion itself.
Parallel routes
A council decision may be challenged through a statutory appeal/complaint while the personal-data accuracy or access issue goes through the data-protection route. Do not assume one automatically suspends the other.
In practice
- Label requests clearly by right.
- Keep statutory appeal deadlines separate from ICO/data deadlines.
- Ask the authority to notify relevant recipients where rectification obligations require it.
What to do
A practical next-step plan
- Identify the data and processing.
- Exercise the relevant UK GDPR right.
- Complain to the authority if mishandled.
- Escalate data-protection concerns to ICO.
- Use separate ombudsman/appeal routes for service or merits issues.
Common traps
Things that often confuse the issue
- Using FOI for your own personal data.
- Assuming public bodies always need consent to process.
- Letting a data complaint replace an appeal deadline.
Evidence worth keeping
Public-sector records can engage exemptions without eliminating your rights.
Legal professional privilege, safeguarding information, third-party personal data and law-enforcement/public-function restrictions can affect disclosure. Ask for the precise basis, whether partial disclosure is possible and whether the organisation has distinguished access from accuracy. A record may lawfully be withheld from access yet still need to be accurate if the organisation continues to use it.
Escalation.
For data-protection handling, complain to the organisation then ICO. For FOI/EIR, use the information-rights review route then ICO. Do not collapse them into one generic “ICO complaint”.
Since June 2026, data-protection complaint handling itself has statutory requirements.
All DUAA data-protection provisions are now in force. Organisations must provide a way for people to make data-protection complaints and must acknowledge such complaints within 30 days, among other handling duties. That complaint route is distinct from the deadline for the underlying SAR or other individual right.
Choose the right route for mixed records.
| You want… | Route to start with |
|---|---|
| Your own social-care file | SAR |
| Council policy used to make decisions | FOI |
| Environmental inspection report | EIR |
| Correction of wrong date of birth | Rectification/data accuracy |
| Emails about you plus general policy | May require data-protection handling for personal data and FOI/EIR for non-personal official information |
Public authorities are subject to data-protection rights as well as FOI duties.
The fact that an organisation is a council, NHS body, regulator or government department does not turn your personal-data request into FOI. SARs, rectification, restriction, erasure/objection where applicable and data-accuracy duties operate under UK data-protection law; FOI/EIR concern access to official recorded information more generally.
Official sources
Check the rules behind this guide
These are official or primary sources for this topic. Rules, scheme terms and deadlines can change, so check the live source before relying on a formal time limit or procedure.