Rights of data subjects under the DPA 1998 [Archived]
Rights of data subjects under the DPA 1998 [Archived]

The following Risk & Compliance guidance note provides comprehensive and up to date legal information covering:

  • Rights of data subjects under the DPA 1998 [Archived]
  • Right of access to personal data
  • Right to prevent processing likely to cause damage or distress
  • Right to prevent processing for purposes of direct marketing
  • Rights in relation to automated decision-making
  • Compensation for breaches of DPA 1998—inaccurate or wrongly disclosed personal data
  • Rectification, blocking, erasure and destruction
  • Right of access to personal information held by public authorities
  • Records obtained under right of access
  • Avoidance of certain contractual terms relating to health records

ARCHIVED: This archived Practice Note provides information on the data protection regime before 25 May 2018 and reflects the position under the Data Protection Act 1998 (DPA 1998). This Practice Note is for background information only and is not maintained.

Changes as a result of the General Data Protection Regulation

The General Data Protection Regulation, Regulation (EU) 2016/679 (the GDPR) (applicable from 25 May 2018) introduces substantial amendments to EU and UK data protection law and replaces the DPA 1998 and Directive 95/46/EC (the Data Protection Directive) from that date.

For further information, see Practice Notes: The General Data Protection Regulation (GDPR) and Rights of data subjects under the GDPR.

A data subject is a living individual who is the subject of personal data, ie data from which he can be identified. For key definitions under the DPA 1998, see Practice Note: Key definitions under the DPA 1998.

For a comprehensive introduction to the GDPR, collating key practical guidance, see: GDPR toolkit.

Right of access to personal data

An individual has a right to be informed by a data controller if they are processing personal data relating to the individual. If so, they are entitled to request (subject access request):

  1. a description of the data

  1. to be informed the purposes for which the data are being processed and to whom it has