Data subject rights,
answered inside the month.

A data subject access request, also called a subject access request (SAR) in the UK, is a request under Article 15. The person is entitled to three things: confirmation of whether you process their data; a copy of that data; and the supporting information in Article 15(1): purposes, categories of data, recipients (in particular any in third countries), the retention period or the criteria for it, their other rights, the right to complain, the source of the data if you did not collect it from them, and meaningful information about any automated decision-making.

The first copy is free. Article 15(3) lets you charge a reasonable fee based on administrative costs for further copies, and requires an electronic copy in a commonly used form where the request was made electronically. Article 15(4) is the main brake: the copy must not adversely affect the rights and freedoms of others, so review for third-party personal data before you send it. The EDPB's Guidelines 01/2022 set out how EU authorities read these provisions.

Article 12(6) allows you to request additional information only where you have reasonable doubts about the identity of the person making the request. It is not a licence to demand a passport for every request. Good practice, consistent with the EDPB guidelines and the ICO's guidance:

• Match against what you already hold. A request from the email address on the account, or from inside a logged-in session, often needs nothing more.
• Ask for the least that resolves the doubt, and do not collect new identity documents you will then have to protect and delete.
• Be more careful where the data is sensitive or the request is for disclosure to a third party, such as a solicitor or a relative; check their authority to act.
• Record the method and why it was proportionate. In the UK, the ICO's position is that the time limit does not begin until you receive the information you reasonably asked for.

Under Article 11, if you genuinely cannot identify the person, you need not acquire extra data to do so, but you must tell them, and act if they give you information that lets you identify them.

Article 17 requires erasure without undue delay where a ground applies: the data is no longer necessary; consent is withdrawn and there is no other lawful basis; the person objects and you have no overriding grounds (or the objection is to direct marketing); the processing was unlawful; erasure is required by law; or the data was collected from a child for an online service. It is not absolute. Article 17(3) preserves processing needed for freedom of expression, a legal obligation, public health, archiving and research, and legal claims, so an invoice you must keep for tax law stays.

Two duties follow an erasure. Article 19 requires you to tell every recipient of the data, such as your processors, unless that is impossible or a disproportionate effort. And if you made the data public, Article 17(2) requires reasonable steps to tell other controllers processing it.

Portability (Article 20) applies only to data the person provided, processed by automated means on the basis of consent or contract; JSON or CSV is fine. Objection (Article 21) is absolute for direct marketing; for legitimate interests or a public task you may continue only with compelling legitimate grounds. Automated decisions (Article 22): where you rely on the contract or explicit consent exceptions, offer human intervention, a chance to give a view and a way to contest the decision. If you build AI features, read this alongside our EU AI Act guide.

The UK GDPR keeps the same rights and the same one-month deadline with a two-month extension. The Data (Use and Access) Act 2025 amended the details, and the ICO confirmed on 19 June 2026 that all of its data protection provisions are now in force. For rights requests, the changes that matter are:

• Reasonable and proportionate searches. You must make reasonable efforts to find the information, but are not required to search in ways that are unreasonable or disproportionate to the importance of access.
• The clock and clarification. The ICO's guidance is that the time limit pauses on the day you ask for clarification and resumes the day after you receive it, and starts only when you have the ID or fee you asked for.
• Complaints. You must help people complain about how you use their data, for example with an electronic complaints form, acknowledge complaints within 30 days and respond without undue delay.
• Automated decisions. More lawful bases can support significant automated decisions, with safeguards, except for special category data.

If you serve both markets, run one process to the stricter reading of each step.