Your personal data has legal protections under UK GDPR. Describe your situation and get instant guidance on your rights and how to enforce them.
Free to use: Run any checker and read your full results — no account needed. Register free to download your results as a PDF report and access the Letters generator.
Describe your situation and we'll check your data protection rights
Tip: Focus on one issue at a time for the clearest answer. If you have multiple issues, run them separately for a full picture on each one.
Include how long you have worked there, what happened, and what you need to know.
Free · No data stored · Guidance only, not legal advice
Analysing your situation...
Checking against current UK employment law
Generating...
What you need to know
The UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 give you a comprehensive set of rights over your personal data. These rights apply to information held about you by any organisation, including employers, companies you buy from, government bodies, and online platforms.
You have the right to request a copy of all personal data an organisation holds about you. This is called a Subject Access Request (SAR). There is no charge for making a SAR. The organisation has one calendar month to respond. They can extend this by a further two months for complex or numerous requests but must tell you within the first month.
Also known as the right to be forgotten, this allows you to request that an organisation deletes your personal data. It applies where the data is no longer necessary for the purpose it was collected, where you withdraw consent, or where the data is being processed unlawfully. Organisations can refuse if they have a legitimate reason to retain the data.
If an organisation suffers a data breach that is likely to result in a risk to your rights and freedoms, they must notify the Information Commissioner\'s Office (ICO) within 72 hours. If the breach poses a high risk to you personally, they must also inform you directly without undue delay. You may be entitled to compensation for distress or financial loss caused by a breach.
You have an absolute right to object to your personal data being used for direct marketing. Once you object, the organisation must stop immediately — they cannot argue a legitimate interest overrides your right. This applies to email, phone, text and post. Unsubscribing from marketing should be honoured promptly.
The Information Commissioner\'s Office (ICO) is the UK's independent regulator for data protection. If you have raised concerns with an organisation and are not satisfied with their response, you can make a free complaint to the ICO at ico.org.uk. The ICO can investigate, issue fines of up to £17.5 million, and order organisations to comply with your rights.
This guidance is for general information only and does not constitute legal advice. Always verify current figures and legislation on GOV.UK or seek professional advice for your specific situation.