Data Protection Myth-Busters

1. Myth 1 of 23

   “You must delete all my data if I ask.”

   What the law actually says

   The right to erasure is not absolute. Reform UK may retain information where required for legal obligations, regulatory compliance, financial records, electoral obligations or the establishment, exercise or defence of legal claims (Article 17(3)).

   Reference: Article 17(3)

   Copy link to this entry

2. Myth 2 of 23

   “You need my consent before sending political communications.”

   What the law actually says

   Consent is not generally required for lawful addressed postal campaigning using electoral data, provided applicable rights and restrictions are respected. Marketing emails and texts to individuals generally require prior consent under PECR. An objection to targeted direct marketing must be respected.

   Reference: UK GDPR Articles 6 and 21; PECR Regulation 22; ICO political campaigning guidance

   Copy link to this entry

3. Myth 3 of 23

   “The one-month deadline always starts when I send an email.”

   What the law actually says

   The normal response period is one calendar month, not necessarily 30 days. Where reasonable doubts about identity justify additional information, the response period starts when that information is received. A lawful request for clarification may also affect the period in circumstances permitted by law.

   Reference: UK GDPR Articles 12(3) and 12(6); Data Protection Act 2018 as amended

   Copy link to this entry

4. Myth 4 of 23

   “You cannot ask me to prove my identity.”

   What the law actually says

   Where reasonable doubts about identity exist, Reform UK may request only the additional information necessary to confirm it. Photographic ID should not be routinely demanded where identity is already sufficiently established.

   Reference: UK GDPR Article 12(6); ICO SAR guidance

   Copy link to this entry

5. Myth 5 of 23

   “You cannot ask whether I was a member, volunteer or candidate.”

   What the law actually says

   We may ask reasonable questions about a requester’s relationship with the Party to locate relevant records efficiently. Clarification must not be used unnecessarily to delay or obstruct a valid access request.

   Reference: UK GDPR Articles 12 and 15; ICO SAR guidance

   Copy link to this entry

6. Myth 6 of 23

   “If you contacted me, you must hold lots of data.”

   What the law actually says

   Not necessarily. Political mailings may be generated from lawful electoral data without creating an extensive permanent record.

   Reference: ICO guidance

   Copy link to this entry

7. Myth 7 of 23

   “If you cannot find my data, you must be lying.”

   What the law actually says

   A search may establish that no personal data is held in the systems reasonably likely to contain it. We must still carry out appropriate searches and explain the outcome accurately.

   Reference: UK GDPR Article 15; ICO SAR guidance

   Copy link to this entry

8. Myth 8 of 23

   “You must search everywhere until you find something.”

   What the law actually says

   The law requires reasonable searches of systems where personal data is likely to exist, not speculative or impossible searches.

   Reference: ICO guidance

   Copy link to this entry

9. Myth 9 of 23

   “Every mistake is a data breach.”

   What the law actually says

   A personal data breach is a security breach leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data. Not every administrative mistake meets that definition, but each suspected incident must be assessed on its facts.

   Reference: UK GDPR Article 4(12); Articles 33 and 34 where applicable

   Copy link to this entry

10. Myth 10 of 23

    “GDPR stops political parties contacting voters.”

    What the law actually says

    The law balances privacy rights with democratic engagement. Political campaigning is a recognised and lawful activity.

    Reference: Recital 56

    Copy link to this entry

11. Myth 11 of 23

    “If I object, processing must stop immediately.”

    What the law actually says

    An objection to processing personal data for direct marketing is absolute: that use must stop. For other processing based on legitimate interests or public task, an objection is assessed under the different test in Article 21(1). Some unrelated lawful processing may continue.

    Reference: UK GDPR Article 21(1)–(3)

    Copy link to this entry

12. Myth 12 of 23

    “If I cancel my membership everything must be deleted.”

    What the law actually says

    Some records must be retained to meet legal, financial, electoral or regulatory obligations.

    Reference: Article 17

    Copy link to this entry

13. Myth 13 of 23

    “If I ask not to be contacted, you should delete my details.”

    What the law actually says

    A minimal suppression record may be retained to ensure the Party respects a direct marketing objection and does not inadvertently contact the person again following a new data import.

    Reference: UK GDPR Articles 5, 6 and 21; ICO suppression guidance

    Copy link to this entry

14. Myth 14 of 23

    “A Subject Access Request means I receive every document.”

    What the law actually says

    An individual has a right to their personal data, not automatically to complete documents or an unrestricted disclosure of internal correspondence. Relevant personal data must be supplied, subject to applicable exemptions and third-party rights.

    Reference: UK GDPR Article 15; Data Protection Act 2018 Schedule 2

    Copy link to this entry

15. Myth 15 of 23

    “If I complain to the ICO, Reform UK has broken the law.”

    What the law actually says

    The ICO assesses complaints independently. A complaint does not demonstrate non-compliance.

    Reference: ICO process

    Copy link to this entry

16. Myth 16 of 23

    “Submitting repeated Subject Access Requests proves an organisation is non-compliant.”

    What the law actually says

    Repeat requests do not themselves establish non-compliance. Each must be assessed fairly; a request may be refused or a reasonable fee charged only where the statutory test for manifestly unfounded or excessive requests is met and the decision can be justified.

    Reference: UK GDPR Article 12(5); ICO guidance

    Copy link to this entry

17. Myth 17 of 23

    “If campaign literature comes through my letterbox, you must have my personal data.”

    What the law actually says

    Not necessarily. Genuinely unaddressed leaflet drops, including Royal Mail Door to Door distribution, need not involve any information identifying the household occupants. Such distribution is generally outside data protection law, although any separate personal-data processing remains subject to it.

    Reference: ICO guidance on political campaigning and direct marketing

    Copy link to this entry

18. Myth 18 of 23

    “I opted out of the Open Electoral Register, so political parties cannot contact me.”

    What the law actually says

    The Open Register and Full Electoral Register are different. Registered political parties may receive and use the Full Register for authorised electoral purposes, subject to statutory restrictions, UK GDPR and any applicable direct marketing objection.

    Reference: Representation of the People Regulations 2001; ICO electoral register guidance

    Copy link to this entry

19. Myth 19 of 23

    “You must have a record of the exact date and system from which my address was obtained.”

    What the law actually says

    If data was not obtained directly from an individual, the right of access includes available information about its source. This does not automatically require an organisation to create historical extraction logs that were never held; any available specific source information must be supplied.

    Reference: UK GDPR Article 15(1)(g)

    Copy link to this entry

20. Myth 20 of 23

    “It is always illegal to contact 16- and 17-year-olds about elections.”

    What the law actually says

    Some 16- and 17-year-olds appear on electoral registration records as attainers. The legality of a particular communication depends on the applicable electoral rules, age-related safeguards, its purpose and the communication method. Registration is not blanket permission for all forms of marketing.

    Reference: Electoral registration legislation; UK GDPR Articles 5 and 6; ICO political campaigning guidance

    Copy link to this entry

21. Myth 21 of 23

    “The same consent rules apply to political letters, emails and texts.”

    What the law actually says

    Different channels are regulated differently. Addressed postal campaigning can generally rely on an appropriate lawful basis without consent, subject to the right to object. Unsolicited political marketing emails and texts to individuals generally need prior consent under PECR.

    Reference: UK GDPR Article 21; PECR Regulation 22; ICO guidance

    Copy link to this entry

22. Myth 22 of 23

    “You must comply with every Subject Access Request, however excessive.”

    What the law actually says

    Article 12(5) allows an organisation to refuse to act on a demonstrably manifestly unfounded or excessive request, or charge a reasonable fee where permitted. The burden of demonstrating the grounds rests with the organisation; an inconvenient or broad request is not automatically excessive.

    Reference: UK GDPR Article 12(5); ICO SAR guidance

    Copy link to this entry

23. Myth 23 of 23

    “The law always gives you exactly 30 days to answer my Subject Access Request.”

    What the law actually says

    The standard period is one calendar month. An extension of up to two further months may be available where justified by complexity or the number of requests, with notice and reasons given within the initial period.

    Reference: UK GDPR Article 12(3)

    Copy link to this entry

Compliance Guidance Note CGN-001 v2.1, November 2026, review June 2027