Data Subject Rights

The UK GDPR gives individuals a set of important rights relating to their personal data, including the right to be informed, access, rectification, erasure, restriction, portability, objection, and rights relating to automated decision-making and profiling.

As a data controller, you will normally need to respond to requests to exercise these rights within one month and free of charge, with only limited exceptions.

This collection is designed as a practical toolkit. The documents are intended to work together so you can (a) explain the rights clearly to individuals and (b) follow a consistent process for acknowledging and handling requests.

When Should You Use These Templates?

Use this collection if you want a structured approach to:

giving individuals a clear explanation of their UK GDPR rights and how to exercise them (alongside your privacy policy or privacy notice);
handling rights requests consistently, including where you need proof of identity, a fee may be payable in limited circumstances, or additional time is required for complex or numerous requests;
keeping responses prompt and well-documented, using a set of letters drafted for common stages in the process.

What Templates Are Included?

Explaining The Rights

Data Subject Rights Guidance Notes

Detailed guidance on each right, including when it applies, how to comply, relevant time limits, and linked supporting documents where relevant.

Data Subject Rights Policy

A customer-facing or employee-facing policy explaining each right in user-friendly language, including how to exercise rights and key exceptions.

Letters For Handling Rights Requests (Common Stages)

Data Subject Rights Letter - Acknowledgement

A first response letter for general use, drafted so it does not assume which specific right the individual is exercising.

Data Subject Rights Letter - Acknowledgement and ID Request

An acknowledgement letter with wording to request confirmation of identity where you have reason to doubt the requester’s identity.

Data Subject Rights Letter - Acknowledgement and Fee Request

A letter to request a fee in the limited cases where a request is manifestly unfounded or excessive, and to explain timing.

Data Subject Rights Letter - Receipt of ID

A letter acknowledging receipt of identity confirmation and confirming the one-month response timeframe runs from receipt of that confirmation.

Data Subject Rights Letter - Receipt of Fee

A letter acknowledging receipt of a requested fee and confirming the response timeframe runs from the date the fee is received.

Data Subject Rights Letter - Additional Time Required

A letter for situations where you need longer to respond, including options reflecting the permitted extension of up to two months for complex or numerous requests.

Why Use These Templates?

These templates help you implement a repeatable process rather than dealing with rights requests on an ad hoc basis:

The policy and guidance notes help individuals understand their rights, and help your organisation apply the rules consistently.
The letter set supports clear, consistent communication at each stage, particularly where identity checks, fees, or extra time are involved.
Used alongside your privacy policy or privacy notice, the policy provides fuller explanations of rights without turning your privacy information into a long technical document.

For more information about each document in this collection, please click on the links below:

Data Subject Rights is part of Business . Just £38.50 + VAT provides unlimited downloads from Business for 1 year.

Frequently Asked Questions

What rights do individuals have over their personal data? +

The UK GDPR gives people a set of rights: to be informed about how their data is used, to access a copy of it, to have inaccurate data corrected, to have data erased in some cases, to restrict processing, to data portability and to object to certain uses. There are also rights around solely automated decisions and profiling. Not every right applies in every situation, so the trigger and the exceptions matter as much as the list.

Is the right to be forgotten absolute? +

No. The right to erasure, sometimes called the right to be forgotten, applies only in specific situations, such as where the data is no longer needed or was processed unlawfully. It does not override everything, and you can refuse where you still need the data for a legal obligation, the exercise or defence of legal claims or freedom of expression. So a deletion request needs assessing against the grounds, not automatic action.

How long do we have to respond to a rights request? +

The same headline timescale as subject access applies: one calendar month from when you receive the request, or from when you receive any identity confirmation you reasonably need. You can extend by up to two further months where the request is complex or you have received several, provided you tell the person within the first month and explain why. Keeping to time, and documenting it, is central to handling rights well.

Can we charge for or refuse a rights request? +

In the normal case you handle rights requests free of charge and must not refuse them. You can charge a reasonable fee, or refuse, only where a request is manifestly unfounded or excessive, and you should be ready to justify that view. If you refuse, tell the person why and let them know they can complain to you and then to the ICO. Fees and refusals are the exception, not a way to manage workload.

Can someone stop us using their data for marketing? +

Yes, and this right is stronger than most. A person has an absolute right to object to direct marketing, so once they object you must stop using their data for that purpose, with no balancing exercise and no exceptions. For other objections, such as to processing based on legitimate interests, you can continue only if you show compelling grounds. Marketing objections should be actioned immediately and suppression recorded.

Business Buy Only £38.50 + VAT!
Unlimited Downloads for One Year
No Auto-Renewal