Can customers request their data?
UK General Data Protection Regulation (UK GDPR), Articles 15–22, as amended by the Data (Use and Access) Act 2025
When this applies
Anyone whose data you hold can submit a Subject Access Request (SAR). You must respond within one calendar month, for free. Separately, since 19 June 2026 the Data (Use and Access) Act 2025 requires you to have a way for people to complain to you directly about your use of their data, acknowledged within 30 days, with the ICO only the second port of call. Ensure you have a process, even informally, to handle both.
When it does not apply
Individual rights obligations are unlikely to apply if you do not collect personal data.
What is at stake
Failure to respond to a subject access request within one calendar month is an ICO-enforceable breach. Fines up to £17.5M or 4% of global turnover. Since 19 June 2026 you must also operate a data protection complaints process, so a missing process is itself a breach.
What to do
Ensure you have a process to respond to Subject Access Requests (SARs) within one calendar month at no charge (extendable by two months for complex requests). Since 19 June 2026 you must also let people complain to you directly about how you use their data, acknowledge within 30 days, and respond without undue delay. Know how to handle requests to erase, rectify, or restrict data.
Where to get this sorted
Set up a Subject Access Request process (Termly) →Check all 33 regulations for your business
This is one of 33 checks getsorted runs. Answer around 12 questions and see your full compliance picture in three minutes. Free, no account.
Check your business →Reviewed: 2026-09-13 · Source: official guidance