UK GDPR: Individual Rights & Complaints: does it apply to you?
UK General Data Protection Regulation (UK GDPR), Articles 15–22
When this applies
Anyone whose data you hold can submit a Subject Access Request (SAR). You must respond within 30 days, for free. Ensure you have a process, even informally, to handle these requests.
When it does not apply
Individual rights obligations are unlikely to apply if you do not collect personal data.
What is at stake
Failure to respond to subject access requests within 30 days is an ICO-enforceable breach. Fines up to £17.5M or 4% of global turnover.
What to do
Ensure you have a process to respond to Subject Access Requests (SARs) within 30 days at no charge. Know how to handle requests to erase, rectify, or restrict data.
Check all 27 regulations for your business
This is one of 27 checks getsorted runs. Answer around 12 questions and see your full compliance picture in three minutes. Free, no account.
Check your business →Reviewed: 2026-06-25 · Source: official guidance