On 31 December 2020, the UK stopped being an EU member state. The next morning, EU GDPR technically ceased to apply on British soil. Parliament had anticipated this — and the solution was to copy the entire regulation into domestic law, word for word, and call it UK GDPR. Your rights survived Brexit. But five years on, the picture is more complicated than that tidy handover suggests.
What Brexit did to your data rights
The EU (Withdrawal) Act 2018 retained GDPR as UK domestic law from 1 January 2021. That means all six core rights you had under EU GDPR transferred intact: access, rectification, erasure, restriction, portability, and objection. The substance of the law didn’t change. The enforcer did.
You no longer take complaints to an EU data protection authority. You go to the ICO — the Information Commissioner’s Office, based in Wilmslow. The ICO has been the UK’s data watchdog since 1984, and it already had teeth before Brexit. British Airways learned this the hard way: the ICO fined them £20 million after a 2018 breach exposed 400,000 customer records (reduced from the initially planned £183 million after COVID-related submissions). Marriott got £18.4 million. TikTok was fined £12.7 million in 2023 for processing children’s data without proper legal basis.
This is an active enforcement body. It fines companies. It investigates. Your complaints go somewhere real.
Your core rights under UK GDPR
The six rights are the same as EU GDPR. Here’s what each actually means in practice:
Right of access — you can ask any company what personal data they hold on you, why they hold it, and who they share it with. This is called a Subject Access Request (SAR). They have one month to respond. No fee. Send it in writing to the company’s Data Protection Officer (or their general customer contact if they don’t have a dedicated DPO).
Right to rectification — if data they hold is wrong or incomplete, you can demand they fix it. Useful when a credit reference or employer background check contains an error.
Right to erasure — the “right to be forgotten.” You can request deletion when data is no longer necessary, when you withdraw consent, or when the company has no legal basis to keep it. It is not absolute. They can refuse if they have legal obligations to retain it. But it is enforceable.
Right to restriction — you can ask them to pause processing your data while a dispute is resolved, rather than delete it entirely.
Right to portability — if a company processes your data by automated means with your consent, you can ask for it in a structured, machine-readable format to move elsewhere.
Right to object — you can object to processing based on legitimate interests, and to direct marketing (unconditionally — they must stop).
To exercise the erasure right specifically, write to the company’s Data Protection contact (usually listed in their privacy policy). State clearly that you are invoking your right to erasure under UK GDPR Article 17. Be specific: name the data you want deleted. Keep a copy.
How to escalate to the ICO
Companies don’t always comply. Some send generic refusals with no legal basis cited. Some simply ignore requests.
If a company refuses your SAR or erasure request without valid grounds, or ignores you entirely, you can file a complaint directly with the ICO at ico.org.uk/make-a-complaint. The process is online. You don’t need a solicitor.
The ICO typically responds with an initial assessment within three months. It will not necessarily fine the company on your behalf, since the ICO prioritises systemic issues over individual disputes. But a complaint creates an official record, and the ICO can require companies to comply and audit their practices. For many companies, receiving an ICO enquiry is enough to prompt action.
The ICO also publishes template letters for SARs and erasure requests. If you’re uncertain how to phrase your request, use them. They’re at ico.org.uk/your-data-matters.
What the Data (Use and Access) Act 2025 changed
The Data (Use and Access) Act 2025 (the DUAA) is where it gets politically uncomfortable. It received Royal Assent in June 2025, and its main data-protection provisions came into force through the first half of 2026. It is the successor to the earlier Data Protection and Digital Information (DPDI) Bill, which fell before the 2024 general election. The DUAA amends UK GDPR and the Data Protection Act 2018 rather than replacing them.
The Act is openly business-friendly. Its stated aim was to reduce compliance burdens for UK businesses. Here is what it means for you.
Legitimate interests got wider. UK GDPR always allowed companies to process data on “legitimate interests,” without your consent, if their interest outweighed yours. The DUAA created a new “recognised legitimate interests” category. It lists activities (crime prevention, national security, safeguarding vulnerable people, emergency response) for which companies do not run the balancing test at all. Notably, this list does not extend to ordinary commercial processing.
Accountability obligations were simplified. Some record-keeping and documentation requirements were eased. This makes the system easier for businesses to navigate. It also means fewer paper trails when things go wrong.
Automated decision-making rules were overhauled. EU GDPR Article 22 gave you the right not to be subject to purely automated decisions with significant effects (like a loan rejection or a job application screen) unless narrow conditions were met. The DUAA replaced this from February 2026. It shifts to a “permission-with-safeguards” model: organisations can now make solely automated significant decisions on any lawful basis, including legitimate interests, provided safeguards are in place. Those safeguards include telling you about the decision, letting you make representations and challenge it, and giving you human intervention. The stricter, near-prohibition regime is kept only where the decision relies on special category data, such as health or ethnicity.
The honest assessment: the DUAA traded some individual protections for business flexibility. Your rights were not abolished. But the space companies have to process your data, and to decide about you by algorithm, has grown.
UK GDPR vs EU GDPR: the key differences
When you read that the UK “kept GDPR,” this is what they mean — and what they’re not saying.
The EU adequacy decision granted to the UK in 2021 means personal data can flow freely between the EU and UK without extra safeguards. The European Commission renewed that decision in December 2025, running to December 2031. But it can still be revoked if UK law diverges significantly from EU standards, which the DUAA has started to do (notably on automated decision-making). Revocation would be disruptive for UK businesses, but it would not directly affect your individual rights.
The more immediate differences:
International transfers — the EU uses Standard Contractual Clauses (SCCs) and adequacy decisions to regulate data flows to third countries. The UK now uses its own parallel framework: International Data Transfer Agreements (IDTAs) and its own adequacy regulations. Different legal mechanisms, similar intent — but the UK can grant adequacy to countries the EU hasn’t, and vice versa.
Accountability — UK organisations face lighter documentation requirements than their EU equivalents under the DUAA changes. This means less visibility into how data is being processed. Not because the processing is different, but because fewer records need to be kept.
Enforcement — the ICO operates independently from EU DPAs. There’s no coordination mechanism for cross-border complaints. If a French company processes your data and you’re a UK resident, the ICO handles your complaint — not the CNIL.
The trajectory matters. The EU continues developing its data protection framework through rulings, guidance, and legislation. The UK is now making independent choices. Brexit created the possibility of divergence. The DUAA began acting on it.
UK-specific data broker and people-search sites
The UK has its own ecosystem of people-search and data aggregation sites that operate under UK GDPR. Here’s where to start with removal requests:
192.com — the largest UK people-search site. Lists names, addresses, phone numbers, and electoral roll data. To opt out: go to 192.com, search for your listing, and use their Opt Out form linked at the bottom of your result. You’ll need to verify identity. They process requests under UK GDPR Article 17 (erasure based on legitimate interests objection).
BT Phone Book (bt.com/phonebook) — lists landline numbers registered with BT. Opt out by calling BT’s ex-directory line or updating your preference in your BT account under “Directory Listing.” Mobile numbers are not listed without consent.
Experian UK — holds marketing data profiles (distinct from your credit report). You can opt out of Experian’s marketing data products via their Opt-Out service at experian.co.uk/privacy. Note: opting out of marketing profiling is separate from accessing or correcting your credit report.
Royal Mail — the PAF (Postcode Address File) is used by many data companies. Royal Mail runs a Mailing Preference Service (MPS) registration at mpsonline.org.uk — registering suppresses your address from direct mail lists. It’s free. It takes 28 days to take effect.
These requests are exercising your UK GDPR right to object (Article 21) — you’re objecting to processing based on legitimate interests for direct marketing purposes. Companies receiving this objection must stop. No balancing test applies to direct marketing objections; it’s unconditional.
What you can do right now
Want to see what data brokers expose about you? See what a scan finds → shows an example report: the kinds of sites that list your name, phone, and address. Once KnytX Shield launches it will find and remove these automatically. Join the waitlist to get in early.