Individual Data Rights

The Data Protection Act gives you several rights over the personal data an organisation holds about you. These rights give you control over information that can identify you.

Your main rights

• Right to be informed: an organisation must tell you how and why it collects and uses your data.
• Right of access: you can ask for a copy of your data, usually free of charge.
• Right to correction: you can have inaccurate data corrected.
• Right to withdraw consent: if you agreed to processing, you can withdraw that consent at any time.
• Right to erasure (right to be forgotten): you can ask for data to be deleted in certain cases.
• Right to restriction: you can ask an organisation to limit how your data is used while an issue is checked.
• Right to data portability: you can obtain your data and reuse it with a different service.
• Right to object: you can object to processing of your personal data.

What this means in practice

Imagine your local athletics club holds your contact details and attendance record. You could ask for a copy, correct a wrong phone number, or withdraw consent for your photo to be displayed on the club website. If you leave, you could ask for your details to be erased or transferred to a new club. You could also restrict use while you query a mistake.

These rights are not unlimited. You can request correction of inaccurate data, but you do not automatically have the right to change or delete all data held about you. An organisation may have a lawful reason to keep some information.