Handling data subject requests

This document reflects Assimilated Regulation (EU) 2016/679, UK General Data Protection Regulation (UK GDPR) and is intended for private-sector commercial organisations in the UK.

Individuals have a number of rights in respect of their personal data under the UK GDPR:

•
a right of access
•
rights to rectification, erasure and restriction of processing
•
a right of data portability
•
a right to object to processing
•
a right not to be subject to a decision based solely on automated processing, including profiling

A data subject can make a request to a data controller to exercise one or more of these rights at any time. They do not need to explain their reasons for making a request and there are strict time limits for complying. Responding to a data subject request can be onerous for a data controller and in most cases you cannot charge the data subject for complying with their request.

With this in mind, it is essential to put in place appropriate processes for handling the full range of data subject requests, to make the process as efficient

To view the latest version of this document and thousands of others like it, sign-in with LexisNexis or register for a free trial.

TAKE A FREE TRIAL

Latest Practice Compliance News

EDPB report highlights challenges and recommendations on the right of access by controllers under CEF 2024

The European Data Protection Board (EDPB) has adopted a report summarising the outcome of the 2024 coordinated enforcement action under the Coordinated Enforcement Framework (CEF). The initiative, aimed at streamlining enforcement and cooperation among 30 Data Protection Authorities (DPAs) across Europe, focused on assessing controllers’ compliance with the right of access.

EDPB releases guidelines on pseudonymisation for public consultation

The European Data Protection Board (EDPB) has published Guidelines 01/2025 on Pseudonymisation for public consultation. The guidelines clarify the legal definition of pseudonymisation under GDPR, emphasising that pseudonymised data remains personal data. They outline pseudonymisation's role as a safeguard for implementing data protection principles, particularly in risk reduction, data minimisation, and ensuring appropriate security levels. The EDPB also addresses the impact of pseudonymisation on data subject rights and its potential use in data transfers to third countries. Such comments should be sent 28th February 2025 at the latest using the provided form.

Key points from trade sanctions office 'no-Russia' guidance

Law360, London: On 7 January 2025, the UK Office of Trade Sanctions Implementation (OTSI) published two new guidance documents focusing on no-Russia clauses and countering Russian sanctions evasion. The no-Russia clause guidance is focused on supporting those exporting or making available common high-priority list items, as well as other items critical to Russian weapons systems and military development, to tailor their due diligence and make use of clauses prohibiting reexport of their products to Russia. The Russian sanctions evasion guidance is intended to aid UK exporters' understanding of Russia's and other countries' circumvention practices to reduce their risk of being targeted by those seeking to evade sanctions. Affected companies should consider whether any adjustments need to be made to their trade compliance programs in light of the best practice recommendations made in the new guidance documents.

The compliance trends and imperatives on tap in 2025

Law360: As we ring in the year 2025, the landscape of corporate ethics and compliance is rapidly evolving, driven by societal changes, technological advancements, and increasingly complex governance demands and geopolitical realities. The world is simultaneously more interconnected and more conflicted than ever, and ethics and compliance challenges can occur in ways and places we have not previously encountered. This article explores the outlook for corporate ethics and compliance in 2025, highlighting key trends, emerging challenges and imperatives for businesses.

View Practice Compliance by content type :

News