This Practice Note explores the rights provided to individuals whose personal data is processed under the United Kingdom General Data protection Regulation, Assimilated Regulation (EU) 2016/679 (UK GDPR). It assumes a degree of knowledge about UK data protection laws. For a general introduction to those data protection laws, including guidance on key data protection concepts and terminology, see the UK data protection law collection.

This Practice Note explores each of the rights provided to individuals, known as data subjects, which are set out in Chapter 3 of the UK GDPR.

The rights are:

1. •

   the right to be informed (Articles 13 and 14)

2. •

   the right of access (Article 15)

3. •

   the right of rectification (Article 16)

4. •

   the right to erasure, also known as the ‘right to be forgotten’ (Article 17)

5. •

   the right to restrict processing (Article 18)

6. •

   the right to data portability (Article 20)

7. •

   the right to object (Article 21)

8. •

   the right not to be subject to automated decision-making and profiling (Article 22)

All of these rights are