Every app, platform and online shop holds some information about the people who use it. UK data protection law gives individuals rights over that information, and the Information Commissioner’s Office (ICO) publishes guidance for the public on how to use them. This guide summarises the ICO’s pages on three of those rights: asking for a copy of personal information, asking for it to be deleted and objecting to how it is used. It describes the ICO’s guidance as read on 13 October 2026. It is general information, not legal advice, and some of the pages say they are under review after recent legislation.
What does the right of access mean?
The ICO’s page on getting copies of personal information says people have the right to ask an organisation if it is using or storing their personal information, and to ask for copies of that information. This is called the right of access, and it is also known as a subject access request, SAR or DSAR.
The guidance is practical:
- Anyone can make one. The page says a solicitor or lawyer is not needed.
- There is a time limit. It says organisations usually have one month to respond.
- Someone else can do it for you. A request can be made on behalf of another person if permission can be proved.
The ICO suggests what to include: a subject line that says “subject access request”, the date, the person’s name and any other names that may be relevant, contact details, any account or reference numbers that help identify the person, what information is wanted and details or dates that help the organisation find it. The page says the reason for the request does not have to be given but may help the organisation find what is needed, and that it helps to say how the information should be received and any accessibility needs.
Can someone ask for everything an organisation holds?
Yes, according to the ICO, a person can ask for all the information an organisation holds about them. The page adds a caution: that does not mean the person will get all of it, because an organisation can sometimes refuse to provide all or some of the information. It also warns that a broad request might bring back a lot of information the person does not need, and that sometimes the organisation is allowed to take longer. The ICO’s advice is to be as specific as possible, which “may help you to get the fastest possible reply and more useful information back”.
The page also has sections on what to expect after making a request, how responses are given, why organisations might partly or fully refuse and what to do if there is no response or the person is unhappy with it. It notes that the guidance is under review because of changes made by the Data (Use and Access) Act.
What is the right to get data deleted?
The ICO’s page on getting data deleted calls this the “right to erasure”, which it says people may sometimes hear called the “right to be forgotten”. It says a person can ask an organisation that holds data about them to delete it and that, in some circumstances, the organisation must then do so.
The page says the right applies only in set circumstances. It lists these, with examples:
- the organisation no longer needs the data for the reason it was collected or used;
- the person consented but has now withdrawn consent;
- the person objected to the use of the data and their interests outweigh the organisation’s;
- the person objected to use of the data for direct marketing;
- the organisation collected or used the data unlawfully;
- the organisation has a legal obligation to erase the data; or
- the data was collected from the person as a child for an online service.
What does the guidance say about data collected from children?
The last item matters for anyone who used social media or a gaming app when young. The ICO page gives that example directly: “You used social media or a gaming app as a child.” It says the law gives children special protection, especially online, because they may be less aware of the risks and consequences of giving their data to organisations. It adds that “even if you are now an adult, you have a right to have your data erased if it was collected from you as a child”.
This connects to the children’s standards covered in our guide to young audiences, the ICO Children’s Code and YouTube’s made for kids rules, which explains what the ICO expects of services likely to be used by children.
How does someone ask for deletion, and can an organisation refuse?
The page says to contact the organisation and say what personal data should be erased. The person does not have to ask a specific individual and can contact any part of the organisation. A request can be verbal or written, but the ICO recommends following up in writing because that allows the person to explain the complaint, give evidence and have proof of the request if the organisation’s response is later challenged. The sample letter on the page asks for a full response within one calendar month.
The page lists situations where an organisation can refuse. One is where keeping the data is necessary for “freedom of expression and information”, which it says includes journalism and academic, artistic and literary purposes. Others are where an exemption applies, and where the request is “manifestly unfounded or excessive”. If an organisation has shared the data with others, the page says it should tell them about the erasure, unless that is impossible or involves disproportionate effort, and that, if asked, it must say who it shared the data with.
What is the right to object?
The ICO’s page on the right to object says a person can ask organisations to stop using their personal information. It explains that withdrawing consent is a related but separate step: if someone consented and now wants to withdraw, the organisation must stop using the information, and the person does not need to submit a right to object request but can just make it clear that consent is withdrawn.
Organisations can sometimes use information without consent, but the page says this does not mean a person loses all control. A person can submit a request to object at any time, although the organisation only needs to comply in certain circumstances. The page lists the purposes against which a person can object, including:
- Direct marketing. Advertising or marketing sent by email, post or calls and targeted at the person specifically. The page says organisations “cannot refuse” if a person objects to this, and that it does not apply to market research or routine customer service messages.
- Official authority and public interest tasks. Public functions set out in law, and tasks carried out in the public interest.
- Research or statistics. Scientific or historical research, or statistical purposes, unless necessary for a public interest task.
- Legitimate interests. The page says organisations cannot simply decide that something is a legitimate interest: they must identify the purpose, justify why using the information is necessary and balance their interests against the person’s.
- Recognised legitimate interests. Interests treated as legitimate by default under data protection law, such as prevention of crime, protecting public security, national security or defence, safeguarding vulnerable people and responding to emergencies. The page says a person can still object to these.
The guidance on this page was last updated on 23 July 2026, in line with changes made by the Data (Use and Access) Act 2025.
How should someone make an objection?
The ICO says the person should contact the organisation directly, say what use of the information they are objecting to and explain why. It stresses clarity, because organisations “may decide whether to comply with your request based on the information you give”. The page says contact details can usually be found in an organisation’s privacy policy or privacy notice, and that a request can be made verbally or in writing at any time, although a written follow-up helps prove what was asked. It provides a template letter, and says no specific words are required.
What does this mean for people who use social platforms?
The ICO pages are written for individuals and describe rights against “organisations”, without naming particular platforms. A person who uses a social platform can read the pages and then look for the platform’s own privacy notice and contact details. The pages do not describe how any platform handles requests, and they do not say how long a specific platform will take.
For creators, there are two separate angles. As users of platforms, creators have the same rights as anyone else over the information platforms hold about them. As people who run email lists, communities or shops, creators may also hold information about fans and customers, which raises its own duties. These ICO public pages do not set out those duties, so a creator in that position should read the ICO’s guidance for organisations or take advice. Our guide to UK tax for creators is a reminder that record keeping already matters for other reasons.
What are the limits of this guide?
The ICO says some of its guidance is under review because of the Data (Use and Access) Act, and that its “plans for new and updated guidance” page will say when updates will be made. The pages summarised here are public guidance, not the law itself, and they describe general rules to which exemptions apply. Whether a request will succeed depends on the facts and on the organisation’s lawful reasons for holding the data. The access request page has a section on what to do if there is no response or the person is unhappy with it.
This article is general information based on published ICO guidance. It is not legal advice. Rules and guidance change; check the ICO’s website for the current position.
Sources: ICO (Getting copies of your information, SAR); ICO (Your right to get your data deleted); ICO (The right to object to the use of your information, updated 23 July 2026)
