Handling data subject requests

Copyright © 2025 LexisNexis

This document reflects Assimilated Regulation (EU) 2016/679, UK General Data Protection Regulation (UK GDPR) and is intended for private-sector commercial organisations in the UK.

Individuals have a number of rights in respect of their personal data under the UK GDPR:

  1. •

    a right of access

  2. •

    rights to rectification, erasure and restriction of processing

  3. •

    a right of data portability

  4. •

    a right of data subjects

A data subject can make a request to a data controller to exercise one or more of these rights at any time. They do not need to explain their reasons for making a request and there are strict time limits for complying. Responding to a data subject request can be onerous for a data controller and in most cases you cannot charge the data subject for complying with their request.

With this in mind, it is essential to have processes for handling the full range of data subject requests, to make these processes as efficient as possible and minimise the risk of non-compliance.

Identifying a data subject request

The UK GDPR does not specify any set

To view the latest version of this document and thousands of others like it, sign-in with LexisNexis or register for a free trial.

Existing user? Sign-in TAKE A FREE TRIAL
Powered by Lexis+®
Latest Practice Compliance News

FCDO announces sanctions against Russian GRU units and officers for cyber attacks

The Foreign, Commonwealth and Development Office (FCDO) has imposed sanctions on three units of Russia's Main Intelligence Directorate (GRU) and 18 military intelligence officers. The measures target units responsible for cyber operations against UK infrastructure and the 2022 Mariupol Theatre bombing. The sanctions package includes restrictions on GRU Unit 26165, which conducted reconnaissance for missile strikes, and officers linked to the 2018 Salisbury poisonings. Additional sanctions target three leaders of 'African Initiative' for conducting Russian-backed disinformation campaigns in West Africa.

OFSI publishes updated guidance and reporting forms

OFSI has updated its Reporting information to OFSI- what to do guidance with new reporting forms and updated links which are set out in the guidance.

HM Treasury publishes 2025 NRA of Money Laundering and Terrorist Financing

HM Treasury has published its 2025 National Risk Assessment (NRA) of Money Laundering and Terrorist Financing. The report highlights that the UK’s open, globally connected economy—while a strength—also makes it vulnerable to abuse by criminals and terrorists. Key threats include fraud, cybercrime, drug trafficking, tax evasion and the misuse of cryptoassets, property and corporate structures. The report emphasizes the growing complexity of money laundering typologies, including trade-based laundering, informal value transfer systems and the use of professional enablers. Terrorist financing threats are also evolving, with funds often raised through legitimate means and transferred via digital platforms or informal networks.

Government responds to 2024 MLR consultation

HM Treasury (HMT) has published the government’s response to the 2024 consultation on the Money Laundering Regulations (MLRs), detailing changes that will be made to the MLRs to close loopholes, clarify requirements and ensure customer due diligence is targeted at high-risk activity. A draft Statutory Instrument will be published for technical feedback in due course, and laid before Parliament later in 2025 if parliamentary time allows. The government says other issues will be addressed through guidance, in collaboration with supervisors, to ensure a consistent, risk-based approach.

View Practice Compliance by content type :  
News
Practice notes
Precedents
Q&As

Popular documents

If a beneficiary signs a deed of disclaimer of their share of an estate and the estate pays their legal

If a beneficiary signs a deed of disclaimer of their share of an estate and the estate pays their legal fees, will that count as a PET against their estate?A disclaimer is the refusal of a gift prior to acceptance. The refusal of the gift must take place before the beneficiary accepts any benefit

Strike out—making an application to strike out a statement of case

Strike out—making an application to strike out a statement of caseA strike out order can be made either following an application by the parties or on the court's own initiative. This Practice Note deals with the scenario of the order being made following a party's application.Making an application

Can shares in a limited company that have not been paid-up at all be cancelled?

Can shares in a limited company that have not been paid-up at all be cancelled?A limited company having a share capital may not alter that share capital, except in the ways listed in section 617 of the Companies Act 2006 (CA 2006). Shares in a company cannot simply be cancelled without following an

Template for regulatory references given by SMCR firms and disclosure requirements

Template for regulatory references given by SMCR firms and disclosure requirements[Insert addressee details]Dear [insert name][It is our understanding that [insert name of prospective employee] [was an employee of yours between the dates of [insert dates as appropriate] OR is a current employee of
If a beneficiary signs a deed of disclaimer of their share of an estate and the estate pays their legal

If a beneficiary signs a deed of disclaimer of their share of an estate and the estate pays their legal

If a beneficiary signs a deed of disclaimer of their share of an estate and the estate pays their legal fees, will that count as a PET against their estate?A disclaimer is the refusal of a gift prior to acceptance. The refusal of the gift must take place before the beneficiary accepts any benefit

Strike out—making an application to strike out a statement of case

Strike out—making an application to strike out a statement of case

Strike out—making an application to strike out a statement of caseA strike out order can be made either following an application by the parties or on the court's own initiative. This Practice Note deals with the scenario of the order being made following a party's application.Making an application

Can shares in a limited company that have not been paid-up at all be cancelled?

Can shares in a limited company that have not been paid-up at all be cancelled?

Can shares in a limited company that have not been paid-up at all be cancelled?A limited company having a share capital may not alter that share capital, except in the ways listed in section 617 of the Companies Act 2006 (CA 2006). Shares in a company cannot simply be cancelled without following an

Template for regulatory references given by SMCR firms and disclosure requirements

Template for regulatory references given by SMCR firms and disclosure requirements

Template for regulatory references given by SMCR firms and disclosure requirements[Insert addressee details]Dear [insert name][It is our understanding that [insert name of prospective employee] [was an employee of yours between the dates of [insert dates as appropriate] OR is a current employee of