What is UK GDPR? A simple explanation of your data rights

If you live in the UK, your personal information is protected by law. Businesses, charities and government departments all collect it, and rules decide what they may do with it. This article explains those rules in plain language: what personal information is, who has to follow the law, which rights you have and where the Information Commissioner's Office (ICO) fits in.

We use only three official pages, from the ICO and GOV.UK, listed at the end. They describe the UK system, not the EU one, so we do not compare the two.

Which law applies in the UK

GOV.UK says data protection legislation controls how your personal information is used by organisations, including businesses and government departments. In the UK, it is governed by the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

What counts as personal information

The ICO defines personal information, also called personal data, as any information that relates to you and that you can be identified from, either on its own or when linked to other information.

This matters because data protection rules only apply if something is personal information. Deciding can be tricky, since the ICO says it depends on who has the information, why they are using it and what other information they may be able to access to identify you. Your name, phone number or email address are your personal information only when someone can use them to identify you.

The ICO gives three examples.

• A garage. A list of car parts it needs to order is not about you. The parts used to repair your car, shown on your invoice, are your personal information.
• A vet. Your dog's medical history on its own is not your personal information. What you owe for the treatment is.
• A vehicle registration number. A supermarket that cannot link a number to anyone does not hold personal information. A council or parking company that can link it to the registered keeper's details, perhaps to issue a parking fine, does.

Who has to follow the rules

GOV.UK says everyone responsible for using personal data has to follow strict rules called "data protection principles", unless an exemption applies. The ICO publishes a guide to the exemptions. Anyone responsible for personal data must make sure it is:

• used fairly, lawfully and transparently;
• used for specified, explicit purposes;
• used in a way that is adequate, relevant and limited to what is necessary;
• accurate and, where necessary, kept up to date;
• kept for no longer than is necessary; and
• handled securely, including protection against unlawful or unauthorised processing, access, loss, destruction or damage.

The ICO adds that all organisations, regardless of their size, must consider your requests to use your rights and respond to you appropriately.

GOV.UK also says some information gets stronger legal protection: race, ethnic background, political opinions, religious beliefs, trade union membership, genetics, biometrics (where used for identification), health, and sex life or orientation. There are separate safeguards for data about criminal convictions and offences.

Your rights

GOV.UK lists the rights you have in relation to your personal data, with some exceptions. The ICO describes each as a right to ask an organisation:

• To be informed. The organisation should tell you what it is doing with your information, why it has it and how to contact it.
• To access. You can ask if it is using or storing information about you, for copies of it, and why and how it is used. The ICO points to the subject access request.
• To erasure. You can ask it to remove information about you.
• To correction. You can ask it to correct inaccurate information about you.
• To object. You can ask it not to use information about you.
• To restriction. You can ask it to limit how it uses your information.
• To data portability. You can ask it to transfer information about you to another organisation. GOV.UK describes this as getting and reusing your data for different services.

You also have rights when an organisation uses your data for automated decision-making without human involvement, and for profiling, for example to predict your behaviour or interests. The ICO says that if an organisation makes a significant decision about you based solely on automated processing, you can make representations, contest the decision and ask for a human to review it. A significant decision is one with a legal or similarly significant effect on you. It adds that the guidance on this is aimed at organisations and is in draft form.

How the rights work in practice

The ICO stresses that organisations need your information to provide services, but this does not mean you lose control of it. A few practical points from its page:

• You only have rights over your own personal information, even if the other person is a family member. In some cases you can act on someone's behalf, but you must prove that you have the authority to do so.
• Information about someone who has died is no longer personal information, so you cannot use these rights on their behalf.
• You do not need a lawyer, and you should not need to spend time or money. You can make a request yourself.
• There are times when an organisation can refuse your request or you may not get the outcome you want. If it refuses, it should usually explain why.

What to do if it goes wrong

The ICO sets out two steps. If you are not happy with the outcome of a request, or with how an organisation handles personal information in general, you can complain to the organisation, which must have a complaints process. If you are not happy with the way it has used your information, you can complain to the ICO.

GOV.UK says you can also contact the ICO for advice. The pages we used do not explain how long a complaint takes or what the ICO may decide, so we do not state either.

How Remove Me can help you see the picture

Exercising your rights starts with knowing who holds what. Remove Me offers a free analysis with no account needed. It searches publicly visible web results, known public data breaches and a register of data brokers, then shows a report, unlocked with a 6-digit code sent by email. It does not yet send erasure requests on your behalf, and it cannot promise any result from the rights described above.