The UK’s independent authority set up to uphold information rights in the public interest, promoting openness by public bodies and data privacy for individuals.

The rights of individuals (Principle 6)

The Data Protection Act gives rights to individuals in respect of the personal data that organisations hold about them. The Act says that:

Personal data shall be processed in accordance with the rights of data subjects under this Act.

This is the sixth data protection principle, and the rights of individuals that it refers to are:

  • a right of access to a copy of the information comprised in their personal data;
  • a right to object to processing that is likely to cause or is causing damage or distress;
  • a right to prevent processing for direct marketing;
  • a right to object to decisions being taken by automated means;
  • a right in certain circumstances to have inaccurate personal data rectified, blocked, erased or destroyed; and
  • a right to claim compensation for damages caused by a breach of the Act.

This section explains these rights, sets out the duties of organisations in this regard and gives examples of good practice. It is divided into six parts, which deal with each of these rights in turn.

Access to personal data

What is a subject access request? What information is an individual entitled to? How should you respond to a subject access request?

Preventing processing likely to cause damage or distress

When can an individual ask you to stop processing their personal data? How should you respond?

Preventing direct marketing

What is direct marketing? What do you need to do if an individual asks you not to send them direct marketing?

Automated decision taking

What is an automated decision? What rights do individuals have regarding this type of decision?

Correcting inaccurate personal data

What rights do individuals have to correct or remove inaccurate personal data that you hold about them?

Compensation

In what circumstances can an individual claim compensation from you for a breach of the Data Protection Act?

.