Rights of data subjects

The United Kingdom General Data Protection Regulation, Assimilated Regulation (EU) 2016/679 (UK GDPR) provides for various rights of data subjects.

For an introduction to the UK GDPR, see Practice Note: The UK General Data Protection Regulation (UK GDPR).

The rights of data subjects under the UK GDPR include:

•
the right to be informed (Articles 13 and 14 of the UK GDPR), which is addressed in a separate sub-topic—see: Transparency and privacy policies and notices—overview
•
rights of access
•
rights

To view the latest version of this document and thousands of others like it, sign-in with LexisNexis or register for a free trial.

TAKE A FREE TRIAL

Latest Information Law News

Information Law weekly highlights—24 July 2025

Welcome to this week’s edition of the Information Law weekly highlights: a hand-picked summary of news analysis, updates and new content related to laws governing the use and dissemination of information and personal data. Each week these highlights focus on developments in key topics such as data protection, ePrivacy, cybersecurity, breach of confidence, misuse of private information, and defamation.

High Court discharges super-injunction in Afghan data breach case (MoD v Global Media and Entertainment Ltd)

Public Law analysis: The High Court discharged a super-injunction in the case of Ministry of Defence v Global Media and Entertainment Ltd, marking a significant moment in the intersection of privacy, national security, and open justice. This judgment (the Judgment) rebalances the competing interests of state secrecy and the public’s right to know, with the Judgment emphasising the need for democratic accountability in the handling of sensitive government errors. The Judgment (which was made public together with the earlier judgments in the case) serves as a crucial reminder of the limits of secrecy in the face of evolving evidence and the fundamental importance of freedom of expression. Written by Dan Tench, partner, and Rosie Coles, associate, at CMS.

Commission launches new UK data protection adequacy assessment process

The European Commission has initiated procedures to adopt new adequacy decisions for EU-UK personal data transfers, following its assessment of the UK Data Use and Access Act which received Royal Assent on 19 June 2025. The Commission's initial evaluation found the UK's legal framework continues to provide data protection safeguards 'essentially equivalent' to EU standards. The draft decisions will require European Data Protection Board opinion, EU Member States committee approval and European Parliament scrutiny before adoption. This follows the Commission's June 2025 six-month technical extension of existing 2021 adequacy decisions to allow assessment of the new UK legislation.

Home Office publishes response to ransomware consultation on new legislative proposals to tackle cybercrime

The Home Office has published its response to the public consultation on legislative proposals to address ransomware. The consultation ran from 14 January to 8 April 2025 and sought views on three measures: a targeted ban on ransomware payments for public sector and regulated critical national infrastructure (CNI); a ransomware payment prevention regime; and a mandatory incident reporting regime. A total of 273 responses were received and 36 engagement events were held. The response confirms ransomware is considered the most serious organised cybercrime threat to UK national security. Feedback was broadly supportive and highlighted several cross-cutting themes, including the need for clarity on scope and definitions, proportionate penalties that avoid revictimising victims, tailored guidance and support, and improved cyber resilience. The government intends to continue to develop the proposals in collaboration with stakeholders, explore appropriate enforcement mechanisms and publish guidance to support implementation.

View Information Law by content type :

News