# Individual rights and subject access requests The eight rights people hold over their data, how fast you must answer, what you may refuse, and how the UK now runs the subject access clock. Source: https://sted.digital/docs/standards/gdpr/individual-rights-and-dsars · Last reviewed 17 October 2026 · Strand Standards and regulations UK GDPR Articles 15 to 22 give people rights to access, correct, erase, restrict, move and object to the use of their data, and Article 12 sets how you answer: within one month, extendable by two further months for complex or numerous requests. EU GDPR has the same rights; the UK has since refined the clock and the search. ## The requirement in plain English People can exercise eight rights over their personal data. The same articles apply in EU GDPR, except where the jurisdiction notes below say otherwise. - **To be informed** (Articles 13 and 14): a privacy notice, given without being asked. - **Access** (UK GDPR Article 15): a copy of their data and the facts about its use, such as purposes, recipients, retention and source. - **Rectification** (UK GDPR Article 16): inaccurate data corrected, incomplete data completed. - **Erasure** (UK GDPR Article 17): deletion where a listed ground applies, such as the data no longer being needed or consent being withdrawn. - **Restriction** (UK GDPR Article 18): the data kept but not used while a dispute is resolved. - **Portability** (UK GDPR Article 20): data given in a machine-readable format, where processing rests on consent or contract and is automated. - **Objection** (UK GDPR Article 21): processing stopped unless you show compelling grounds; for direct marketing, always stopped. - **Automated decisions** (Article 22 in the EU; in the UK, the articles that replaced it): safeguards against significant decisions made with no human involvement. How you answer is set by UK GDPR Article 12. When you correct, erase or restrict data, you must also tell each recipient you disclosed it to, unless that is impossible or disproportionate (UK GDPR Article 19). Requests are free unless they are manifestly unfounded or excessive, when you may charge a reasonable fee or refuse, and explain why (UK GDPR Article 12(5)). You may ask for proof of identity where you have reasonable doubt (UK GDPR Article 12(6)). You answer without undue delay and within one month, extendable by two further months for complexity or volume, telling the person within the first month (UK GDPR Article 12(3), with the period set by UK GDPR Article 12A). UK GDPR Since 5 February 2026, the UK clock under UK GDPR Article 12A is one calendar month from the latest of three moments: receiving the request, receiving any identity information you asked for, or receiving any fee. Where you hold a lot of data about the person and genuinely need them to say what they want, you may ask, and the clock stops until they reply. Article 15 of the UK GDPR now also limits access to what a reasonable and proportionate search finds, a change treated as law from 1 January 2024. Automated decisions sit in four new articles that replace Article 22; see the [Data (Use and Access) Act 2025 changes](/docs/standards/gdpr/data-use-and-access-act-changes). From 19 June 2026 you must also have a way for people to complain to you, and acknowledge each complaint within 30 days (Data Protection Act 2018 section 164A). EU GDPR In the EU the month runs from receipt of the request (EU GDPR Article 12(3)), and the text has no written pause while you wait for clarification. Asking the person to narrow a broad request is allowed, but plan to answer within the month. Automated decisions stay under EU GDPR Article 22: a right not to be subject to a solely automated decision with legal or similarly significant effects, subject to three exceptions and safeguards. This is guidance to help you understand the requirement, not legal advice. ## What good looks like A 25-person recruitment platform names one person, the operations lead, as owner of rights requests, with a deputy for holidays. Everyone who answers customers knows that any request for "my data", in any channel, goes to that owner the same day. Each request is logged on arrival with its date, the right asked for, the identity check and the due date, worked out in calendar months. The owner keeps a search plan that lists every system holding personal data, taken from the record of processing, so a search covers the CRM, the support desk, email, chat and backups in the same order each time. Redaction of other people's data is checked by a second person before anything goes out. The reply says what was searched, what was withheld and why, and how to complain. Erasure and correction are passed to processors and recipients and logged. Every quarter the owner reviews the log for missed deadlines and repeat themes, and feeds what it finds into the next policy review. ## Evidence an auditor expects - **Rights request log**: usual rather than required in the text; the auditor samples requests for receipt date, due date and reply date. - **Identity checks**: usual; the auditor checks they were proportionate and did not delay the reply without reason. - **Extension notices**: required where you extend; the auditor checks they went out within the first month with reasons. - **Replies and redaction records**: usual; they show what was disclosed, what was withheld and the exemption relied on. - **Rights handling policy**: usual; the auditor checks staff know where requests go. - **Recipient notifications**: required by Article 19 where data was disclosed; the auditor looks for the notice to each recipient. ## Common mistakes ### Counting 30 days instead of a month A 30-day timer sets the date a day early for a request made in a 31-day month, and one or two days late for a request made in February, which is a missed deadline. Set the due date by calendar date. ### Missing requests that do not use the right words A complaint that ends with "and send me everything you hold on me" is a subject access request. Train front-line staff to spot one and pass it on that day. ### Searching only the main system The CRM is searched, but the Slack thread, the recorded call and the shared spreadsheet are not. Base the search on the record of processing, and record what you searched. ### Refusing as excessive without a reason on file Refusing a request, or charging for it, as manifestly unfounded or excessive (UK GDPR Article 12(5)) needs a high bar. A large or inconvenient request is not excessive in itself; write down why a refusal or fee is justified before you send it. ### Erasure that stops at your own database Deleting the record in your app but not in the email tool, the analytics platform or the processor's copy leaves the right half met. Article 19 also requires you to tell the recipients. ## How Sted helps Sted's knowledge base includes a Data Subject Rights Request Record (REC-DSRR) under the Data Subject Rights Handling Policy (POL-DSR), with ten sections from the request and its identity check, through whether the right applies and the deadline, to what the reply told the person and which recipients were notified. Records are part of the Full Management System plan. For UK GDPR and for EU GDPR Sted's knowledge base carries 34 policies, procedures and notices and 35 record templates each, led by the Personal Data Protection Policy, the Data Subject Rights Handling Policy, the Data Retention and Erasure Policy and the two privacy notices. A record is opened, completed, submitted for closure and closed (or withdrawn); closure is reviewed by the document owner. Records are part of the Full Management System plan. Sted does not answer requests from individuals for you. You search your systems, reply, and log each request in its record. ## Related guides and terms - [Subject access requests](/docs/guides/data-subject-access-requests): the step-by-step way to handle one. - [Subject access request](/docs/glossary/subject-access-request): the term defined. - [Transparency and privacy notices](/docs/standards/gdpr/transparency-and-privacy-notices): where you tell people about their rights. - [Records of processing activities](/docs/standards/gdpr/records-of-processing): the map your search plan is built from. - [UK GDPR and EU GDPR](/docs/standards/gdpr): how rights fit with the rest of the regulation. - [Records](/docs/product/records): where each request is logged in Sted. ## Frequently asked questions Q: Is the subject access deadline one month or 30 days? A: One calendar month. A request received on 3 March is due on 3 April, and where the next month has no matching date the deadline is its last day. Counting 30 days gives the wrong answer in most months, and regulators check the date, not the count. Q: Can I charge a fee for a subject access request? A: Not normally. You may charge a reasonable fee, based on your administrative cost, only when a request is manifestly unfounded or excessive or the person asks for further copies. In the UK the clock does not start until any fee you charge is paid. Q: Does a request have to mention GDPR to count? A: No. A request can arrive by email, letter, phone or social media, to anyone in the organisation, and need not use the words subject access. If someone asks for their data, the clock has started, so staff who answer customers need to recognise one.