Your data rights
What we hold about you, what the law says we can do with it, and how to ask us to change or stop it.
Read this first
Twelve common things people get wrong about UK GDPR
Most complaints we receive are based on a misunderstanding of what the law actually says. Spend two minutes with our Myth-Busters page first. It might answer your question without you needing to make a request at all.
Read the 12 Myth-BustersTake action
What do you need to do?
Choose one of the options below. Each takes a few minutes to complete.
Make a Subject Access Request
Ask for a copy of every piece of personal data we hold about you, under UK GDPR Article 15.
Start the request
Stop us contacting you
Choose which channels (email, SMS, post, phone) you want to stop hearing from us on. Under Article 21.
Open the form
Complain to the ICO
If you are not satisfied with our response, you can raise concerns with the Information Commissioner's Office, the UK regulator for data protection, at ico.org.uk. This right is yours to use at any time.
Learn how to complain
The basics
How we use your data, in plain English
The six lawful bases
UK GDPR Article 6 sets out six lawful bases for handling personal data. Different bases apply to different activities.
- Consent, Art. 6(1)(a). For things like email updates that you actively sign up for.
- Contract, Art. 6(1)(b). For member subscriptions and supplier arrangements.
- Legal obligation, Art. 6(1)(c). For example, Electoral Commission donations reporting.
- Vital interests, Art. 6(1)(d). To protect someone's life. We do not currently rely on this basis.
- Public task, Art. 6(1)(e). For duties in the public interest. We do not currently rely on this basis.
- Legitimate interests, Art. 6(1)(f). For political communication using the Electoral Register.
You only need one of the six. Consent is one of them, not the default.
Your rights, accurately stated
Some rights are absolute. Others are weighed against other factors. Below is the accurate position.
- Access, Art. 15. We tell you what we hold about you.
- Rectification, Art. 16. We correct inaccurate data.
- Erasure, Art. 17. Not absolute. We may keep data we are required to retain.
- Objection, Art. 21. Weighed, not automatic stop. Processing may continue if we have compelling grounds.
- Restriction and portability, Art. 18 and Art. 20. In defined circumstances.
How long we take
We respond within one calendar month from the date your identity is verified. For complex requests we may extend by up to two further months and will tell you why. This is Article 12(3).