Individuals Rights Under UK GDPR

Posted on by Know Your Compliance
GDPR on clipart written across a mirrored building
05
Nov

The UK GDPR contains rights for individuals in Articles 12-22 of the Regulation. These rights give a data subject some control over their personal data. Such rights enable people to access personal information, correct errors and in certain situations, object to the processing.

Why Are Data Subject Rights Important?

If you are an individual whose data is being processed, understanding your rights under the UK GDPR is essential. A processor should be telling you what they are doing with your personal data is through a ‘Privacy Notice‘. You will have definately come across these on the internet and maybe even letters or leaflets. The person or business processing your information has a legal obligation to tell you about your rights and how you can enact them.

If you are a data controller or processor, your responsibilities under the UK GDPR mean you have a legal duty to advise individuals what you are doing with their data. This includes informing them of their individual rights under the UK GDPR. The ICO provide detailed guidance on what each of the data protection individual rights are and how you can comply with the legislation and regulations.

The Right to be Informed

We have listed the data subject rights in blue as set out in the data protection regulation. The right to be informed refers to the mandatory information that a processor has to give to an individual at the time they collect the personal data.

Where personal data is obtained directly from the individual, a privacy notice is used to inform the data subject of their rights. The information on the notice should include (but is not limited to): –

  • The identity & the contact details of the controller & DPO.
  • The purpose(s) of the processing.
  • The legal basis for the processing.
  • The recipients or categories of recipients of the personal data.
  • Any intention to transfer the personal data to a third country or international organisation.
  • The existence of any automated decision-making.
  • The period for which the personal data will be stored.
  • The right to request:
    • access to personal data
    • rectification or erasure of personal data
    • restriction of processing concerning the data subject
    • object to processing
    • data portability.

Rights Under UK GDPR

  • The right to be informed
  • The right of access
  • The right to rectification
  • The right to erasure
  • The right to restrict processing
  • The right to data portability
  • The right to object
  • Rights on automated decision making