Handling data subject requests

Copyright © 2025 LexisNexis

This document reflects Assimilated Regulation (EU) 2016/679, UK General Data Protection Regulation (UK GDPR) and is intended for private-sector commercial organisations in the UK.

Individuals have a number of rights in respect of their personal data under the UK GDPR:

  1. •

    a right of access

  2. •

    rights to rectification, erasure and restriction of processing

  3. •

    a right of data portability

  4. •

    a right of data subjects

A data subject can make a request to a data controller to exercise one or more of these rights at any time. They do not need to explain their reasons for making a request and there are strict time limits for complying. Responding to a data subject request can be onerous for a data controller and in most cases you cannot charge the data subject for complying with their request.

With this in mind, it is essential to have processes for handling the full range of data subject requests, to make these processes as efficient as possible and minimise the risk of non-compliance.

Identifying a data subject request

The UK GDPR does not specify any set

To view the latest version of this document and thousands of others like it, sign-in with LexisNexis or register for a free trial.

Existing user? Sign-in TAKE A FREE TRIAL
Powered by Lexis+®
Latest Practice Compliance News

OFSI amends General licence INT/2025/5635700 and General Licence INT/2022/2470156

The Office of Financial Sanctions Implementation (OFSI) has announced amendments to two general licences. The changes affect Licence INT/2025/5635700 and Licence INT/2022/2470156, both of which relate to Russian sanctions implementation. The amendments modify existing permissions regarding oil price caps and exempt projects.

Sanctioned company director convicted of failing to give information

Law360, London: A sanctioned company director was convicted in a criminal court in London on 25 June 2025 of failing to adequately respond to a request for information by the UK's sanctions agency.

FCDO issues new Russia sanctions guidance for non-UK businesses

The Foreign, Commonwealth & Development Office (FCDO) has published new guides on UK Russia sanctions compliance for non-UK businesses operating outside the UK. The guides include general compliance principles and country-specific guidance for businesses in Kazakhstan, Uzbekistan, Kyrgyzstan, Georgia and Armenia. The materials aim to help foreign businesses understand UK sanctions requirements and implement risk management procedures.

LeO announces launch of new model complaints procedure for legal sector

The Legal Ombudsman (LeO) announced the development of a Model Complaints Resolution Procedure (MCRP) designed to standardise first-tier complaint handling across legal service providers in England and Wales. This initiative responds to data indicating that 48.7% of assessed complaints in 2024–25 experienced unreasonable initial handling and highlights issues with consumers bypassing complete in-house complaint processes. Developed in collaboration with sector regulators, the MCRP will be piloted during summer 2025, followed by a full consultation in early 2026. The procedure aims to achieve early resolution through swift explanations and meaningful apologies and will be supported by comprehensive materials, including template letters, toolkits, and guidance, to enhance client trust, promote consistency, and reduce costs.

View Practice Compliance by content type :  
News
Practice notes
Precedents
Q&As

Popular documents

Late payment penalties—inheritance tax

Late payment penalties—inheritance taxWhile interest often accrues on overdue tax, the late payment of certain taxes may also attract a penalty. For information on the interest accruing on overdue tax, see Practice Notes: IHT—payment deadlines on death—Interest on IHT and Interest on late paid

If a beneficiary signs a deed of disclaimer of their share of an estate and the estate pays their legal

If a beneficiary signs a deed of disclaimer of their share of an estate and the estate pays their legal fees, will that count as a PET against their estate?A disclaimer is the refusal of a gift prior to acceptance. The refusal of the gift must take place before the beneficiary accepts any benefit

Strike out—making an application to strike out a statement of case

Strike out—making an application to strike out a statement of caseA strike out order can be made either following an application by the parties or on the court's own initiative. This Practice Note deals with the scenario of the order being made following a party's application.Making an application

Glossary—Latin legal terms

Glossary—Latin legal termsDespite attempts in recent years to simplify the language used in legal cases, there are still a number of Latin phrases commonly used in personal injury claims. The following Latin phrases are listed in alphabetical order:Latin
Late payment penalties—inheritance tax

Late payment penalties—inheritance tax

Late payment penalties—inheritance taxWhile interest often accrues on overdue tax, the late payment of certain taxes may also attract a penalty. For information on the interest accruing on overdue tax, see Practice Notes: IHT—payment deadlines on death—Interest on IHT and Interest on late paid

If a beneficiary signs a deed of disclaimer of their share of an estate and the estate pays their legal

If a beneficiary signs a deed of disclaimer of their share of an estate and the estate pays their legal

If a beneficiary signs a deed of disclaimer of their share of an estate and the estate pays their legal fees, will that count as a PET against their estate?A disclaimer is the refusal of a gift prior to acceptance. The refusal of the gift must take place before the beneficiary accepts any benefit

Strike out—making an application to strike out a statement of case

Strike out—making an application to strike out a statement of case

Strike out—making an application to strike out a statement of caseA strike out order can be made either following an application by the parties or on the court's own initiative. This Practice Note deals with the scenario of the order being made following a party's application.Making an application

Glossary—Latin legal terms

Glossary—Latin legal terms

Glossary—Latin legal termsDespite attempts in recent years to simplify the language used in legal cases, there are still a number of Latin phrases commonly used in personal injury claims. The following Latin phrases are listed in alphabetical order:Latin