UK privacy rights: UK GDPR and the Data Protection Act 2018

The UK GDPR protects individuals whose personal data is processed. Under Article 3 it applies to organisations established in the UK, and to organisations elsewhere that offer goods or services to people in the UK or monitor their behaviour there.

Article 9 prohibits processing biometric data for the purpose of uniquely identifying a person unless a listed condition applies, such as explicit consent.

• Access (Article 15). A copy of your personal data and information about how it is used.
• Erasure (Article 17). Deletion where, for example, the organisation no longer needs the data, you withdraw consent, you object and your interests outweigh the organisation's, or it used your data unlawfully.
• Objection (Article 21). You can object to direct marketing, which the organisation must stop, and to uses based on legitimate interests or a public task, which it can continue only in limited cases, such as where it shows a compelling reason.

Erasure does not apply where the organisation needs the data for freedom of expression and information, a legal obligation, a public task, archiving or research, or legal claims.

1. 1.Contact the organisation. A request can be verbal or written and can go to any part of the organisation. The regulator recommends writing, so that you have a record.
2. 2.Say which right you are using and what data it concerns.
3. 3.Be ready to confirm your identity. The organisation may delay dealing with a request until it is confirmed.
4. 4.For access requests, reply promptly if the organisation reasonably asks which information you want. The clock pauses until you answer.

Article 12A sets the time limit: one month beginning when the organisation receives the request or, if later, the identity information or fee it asked for. It may extend by two further months because of the complexity or number of requests if it tells you within the first month and gives reasons.

Under section 164A of the Data Protection Act 2018, in force since June 2026, organisations must make it easy to complain to them, acknowledge a complaint within 30 days, respond without undue delay and tell you the outcome. Under section 165 you can complain to the Information Commission, which recommends raising the concern with the organisation first. The Commission cannot award compensation. You can also go to court.

The Information Commission succeeded the Information Commissioner's Office (ICO) on 30 September 2026. The government says the regulator's role, responsibilities and powers are unchanged. Guidance remains at ico.org.uk.

In May 2022 the regulator fined Clearview AI £7.5 million over its facial recognition database. In October 2025 the Upper Tribunal held that the regulator had jurisdiction and returned the case to the First-tier Tribunal. In December 2025 the regulator reported that Clearview had permission to appeal further, so check the current position.

In a 2024 consultation on generative AI, the regulator said individual rights apply to personal data in training data and in model outputs, and that developers should have a clear and effective process for people to use them. It also recognised that models retain imprints of training data. That document sets out emerging thinking, not settled guidance.

Separately, intentionally creating a purported intimate image of another person without their consent can be a criminal offence under section 66E of the Sexual Offences Act 2003, in force since 6 February 2026. Criminal law differs between parts of the UK.

A deletion or objection request can reach stored personal data such as source images, dataset entries and outputs. It does not remove a person from a model that has already been trained.