Handling data subject requests

Copyright © 2024 LexisNexis

This document reflects Assimilated Regulation (EU) 2016/679, UK General Data Protection Regulation (UK GDPR) and is intended for private-sector commercial organisations in the UK.

Individuals have a number of rights in respect of their personal data under the UK GDPR:

  1. •

    a right of access

  2. •

    rights to rectification, erasure and restriction of processing

  3. •

    a right of data portability

  4. •

    a right to object to processing

  5. •

    a right not to be subject to a decision based solely on automated processing, including profiling

A data subject can make a request to a data controller to exercise one or more of these rights at any time. They do not need to explain their reasons for making a request and there are strict time limits for complying. Responding to a data subject request can be onerous for a data controller and in most cases you cannot charge the data subject for complying with their request.

With this in mind, it is essential to put in place appropriate processes for handling the full range of data subject requests, to make the process as efficient

To view the latest version of this document and thousands of others like it, sign-in with LexisNexis or register for a free trial.

Existing user? Sign-in TAKE A FREE TRIAL
Powered by Lexis+®
Latest Risk & Compliance News

New Risk & Compliance forecast as at 20 November 2024

Our new Risk & Compliance forecast (as at 20 November 2024) is now live. This month we report on items including: (1) publication of the long-awaited government guidance on the failure to prevent fraud offence; (2) consultation by the Financial Action Task Force (FATF) on proposed changes to FATF Standards and updates to grey listing criteria by FATF to increase focus on risk; (3) updates on the Data (Use and Access) Bill and Employment Rights Bill, and (4) three new consultations from the Solicitors Regulation Authority (SRA) on client money management and consumer protection.

HM Treasury issues advisory on Oil Price Cap evasion tactics

HM Treasury (HMT)and the Office of Financial Sanctions Implementation (OFSI) have released an advisory concerning the Oil Price Cap (OPC) regime. The guidance specifically addresses evasion strategies involving the manipulation of product origin through the use of fabricated and falsified Certificates of Origin (CO). This advisory aims to alert relevant parties to the risks associated with such practices and to enhance compliance efforts within the oil trade sector.

Risk & Compliance weekly highlights—21 November 2024

This week's edition of Risk & Compliance weekly highlights includes: the latest financial sanctions updates, an updated list of businesses not compliant with money laundering regulations from HM Revenue & Customs (HMRC), initiation of a consultation for legal regulators to combat economic crime by the Legal Services Board (LSB) and final versions of a suite of new guidance to support in-house solicitors from the SRA.

FCDO implements new sanctions against international kleptocrats

The Foreign, Commonwealth & Development Office (FCDO) has announced a significant expansion of the UK's anti-corruption efforts through the imposition of sanctions on three high-profile kleptocrats and their associates. These measures, implemented under the Global Anti-Corruption Sanctions Regulations 2021 (SI 2021/488), include asset freezes and travel bans targeting individuals accused of embezzling substantial sums from Ukraine, Angola, and Latvia. The sanctions mark the commencement of a new campaign by the Foreign Secretary to combat corruption and illicit finance, with cross-governmental cooperation to protect UK interests and support global economic integrity. The initiative is bolstered by ongoing collaboration with the National Crime Agency's International Anti-Corruption Coordination Centre (IACCC) and International Corruption Unit (ICU), demonstrating a comprehensive approach to tackling financial crime and sanctions evasion.

View Risk & Compliance by content type :  
News
Practice notes
Precedents
Q&As

Popular documents

Public statement on data breach

Public statement on data breachStatement by [insert name of organisation] concerning a significant [cyber-attack OR data protection breach] on [insert date].On [date], we were made aware of an incident threatening the security of personal data for which we are responsible. [We OR [insert name of

Training materials—GDPR and data protection compliance—for staff

Training materials—GDPR and data protection compliance—for staffThis Precedent presentation has been designed as an aid to train your staff on the general principles of data protection and how to manage this in the workplace. This Precedent is of general application, but incorporates the

Can a limited company make a subject access request? Can a director of a limited company ask for

Can a limited company make a subject access request? Can a director of a limited company ask for recordings of calls with us? If yes, what personal data must we provide?This Q&A draws on the Information Commissioner’s Office’s (ICO’s) guidance on business-to-business marketing, which may or may not

Data protection officer—DPO—job description and role profile

Data protection officer—DPO—job description and role profile1DPO detailsName of organisation[Insert name of organisation]Name of DPO[Insert name]Reports to[Insert name and/or position]Full time/part time[Insert]Details of any other roles held within the organisation[Insert details of any other roles
Public statement on data breach

Public statement on data breach

Public statement on data breachStatement by [insert name of organisation] concerning a significant [cyber-attack OR data protection breach] on [insert date].On [date], we were made aware of an incident threatening the security of personal data for which we are responsible. [We OR [insert name of

Training materials—GDPR and data protection compliance—for staff

Training materials—GDPR and data protection compliance—for staff

Training materials—GDPR and data protection compliance—for staffThis Precedent presentation has been designed as an aid to train your staff on the general principles of data protection and how to manage this in the workplace. This Precedent is of general application, but incorporates the

Can a limited company make a subject access request? Can a director of a limited company ask for

Can a limited company make a subject access request? Can a director of a limited company ask for

Can a limited company make a subject access request? Can a director of a limited company ask for recordings of calls with us? If yes, what personal data must we provide?This Q&A draws on the Information Commissioner’s Office’s (ICO’s) guidance on business-to-business marketing, which may or may not

Data protection officer—DPO—job description and role profile

Data protection officer—DPO—job description and role profile

Data protection officer—DPO—job description and role profile1DPO detailsName of organisation[Insert name of organisation]Name of DPO[Insert name]Reports to[Insert name and/or position]Full time/part time[Insert]Details of any other roles held within the organisation[Insert details of any other roles