GDPR rights give people ways to understand, access and challenge how organisations use their personal data. These rights are set out in the UK General Data Protection Regulation (UK GDPR) and affect information about job applicants, current and former workers, as well as customers.
A worker who questions an absence record or asks for their personal information may be exercising a legal right without mentioning GDPR. If the request is treated as an ordinary query and passed between departments, the organisation can miss its response deadline.
This guide explains the eight GDPR rights, their limits and the practical steps employers should take when someone exercises them.
Individual rights under GDPR concern how personal information is collected, used, corrected, shared and retained. The person the information relates to is called the data subject.
An employer will usually be the controller of its employment records, meaning it decides why and how that information is used. The Information Commissioner’s Office (ICO) explains these responsibilities in its employment records guidance.
The eight rights cover the following areas.
People must receive clear information about how their personal data will be used. This includes the purposes, lawful basis, retention periods, relevant sharing arrangements and their rights.
The right to be informed generally requires this information when data is collected directly from the individual. When data comes from another source, provide privacy information within a reasonable period of obtaining it and no later than one month. If the data is used to contact the person or will be shared, provide the information by the first communication or disclosure if sooner. Limited exceptions apply.
For employers, this means providing accessible privacy information to applicants and workers. A privacy notice explains what the organisation does; it does not, by itself, obtain consent or provide a lawful basis. A GDPR privacy policy template can help organise the information, but it must reflect actual practices.
People can ask whether an organisation processes their personal data, obtain a copy and receive supplementary information about its use. This is commonly called a subject access request, or SAR.
The right of access concerns the person’s own information. It does not automatically entitle them to every complete document in which they are mentioned. Information about others and applicable exemptions need careful consideration.
For the detailed process, see the Human Focus guide to subject access requests under GDPR.
People can ask for inaccurate personal data to be corrected and, where appropriate, incomplete information to be completed.
Under the right to rectification, an employer should consider the evidence and take reasonable steps to check accuracy. A wrong start date or incorrectly recorded absence may need correcting.
A disagreement with a recorded opinion is more complicated. An accurate record that a manager held a particular opinion does not necessarily become inaccurate because the worker disagrees. The record should distinguish facts from opinions and identify whose opinion it records where appropriate.
The right to erasure, sometimes called the right to be forgotten, allows people to request deletion in specified circumstances. These include information that is no longer needed for its original purpose or has been processed unlawfully.
It is not an automatic right to have every record removed. Employers may need to retain particular information to meet a legal obligation or establish, exercise or defend legal claims.
Assess the records and reasons for keeping them separately. A valid reason to retain payroll information does not justify keeping an entire personnel file indefinitely.
People can request limits on the use of their information in certain circumstances. For example, they may dispute its accuracy and request restriction while the organisation checks it.
The right to restrict processing generally allows the organisation to retain the information while limiting further use. Further processing is permitted only in specified circumstances, such as with consent or for legal claims.
Restriction must work in practice. Flagging a disputed record is insufficient if managers can still use it in routine decisions. Where a restriction is lifted, the individual must be informed beforehand.
The right to data portability allows people to receive certain personal data in a structured, commonly used, machine-readable format and, where technically feasible, have it transferred directly to another controller.
It applies where processing is automated and based on consent or a contract. It covers information the individual provided, which can include information observed through their use of a service.
It does not cover all information an organisation has created about someone. An employer’s assessment or inferred profile is not automatically portable, although it may fall within a subject access request.
People can object to certain uses of their personal data, including processing based on legitimate interests or necessary for a task carried out in the public interest.
For these grounds, the organisation must consider the person’s particular circumstances. Continuing may be possible where compelling legitimate grounds override their interests, rights and freedoms, or the processing is needed for legal claims.
Direct marketing is different. If someone objects to their data being used for direct marketing, the organisation must stop using it for that purpose, including related profiling. Keeping minimal information on a suppression list can help prevent further marketing.
Additional safeguards apply where personal data is used to make a decision with a legal or similarly significant effect and there is no meaningful human involvement. A recruitment system that automatically rejects an applicant may fall within these rules.
The UK framework changed on 5 February 2026. Under Articles 22A to 22D, introduced by the Data (Use and Access) Act 2025, safeguards must enable the individual to:
- Receive information about the decision.
- Explain their position or provide further information.
- Obtain human intervention.
- Contest the decision.
These rules do not amount to a general ban on automated decisions. Additional restrictions apply to significant solely automated decisions involving special category data, such as health information.
Employers using automated tools need to understand how decisions are reached and how a person can challenge them.
A clear process helps staff recognise a request, pass it to the right person and act within the relevant deadline.
Look at what the person is asking for, rather than the terminology they use. A request to correct a record, provide personal information or stop marketing can engage different rights.
Staff should record when the request arrived, what was requested and who received it, including requests made verbally. They should then pass it promptly to the designated person or team.
The ICO’s employer guidance confirms that a SAR can reach any part of an organisation. Requiring it to be resubmitted to a special inbox can introduce unnecessary delay.
Take proportionate steps to confirm identity and any authority to act for someone else. Do not routinely demand identification documents from a worker whose identity is already clear.
One message may engage several rights. A worker might ask for an absence record to be corrected and its use restricted while accuracy is checked. Identify each part so that none is overlooked.
The ICO’s guidance on responding to requests explains identity checks and the treatment of requests involving multiple rights.
Under Articles 12 and 12A of the UK GDPR, organisations must respond without undue delay, normally within one calendar month.
Necessary identity checks or a lawful fee can affect when the period starts. An extension of up to two further months may be available where necessary because of complexity or the number of requests from the individual. Explain the extension and reasons within the initial month.
A SAR clock can pause where clarification is reasonably required to identify the information or processing concerned. This is not a general pause for every type of rights request.
The one-month deadline is not permission to postpone an action that should happen sooner, such as stopping direct marketing after an objection.
Identify the information, its purpose and the lawful basis for using it. Then assess the right being exercised, any applicable exception and whether other people’s information is involved.
Avoid blanket decisions such as “all employee records must be kept” or “all deletion requests must be accepted”. Document the reason for the decision and obtain specialist advice where the position is unclear.
Make sure approved changes reach the relevant systems and service providers. Under the ICO’s guidance on individual rights and data sharing, recipients generally need to be told about rectification, erasure or restriction unless doing so is impossible or involves disproportionate effort.
Explain what has been done in clear language and communicate securely. If refusing all or part of a request, provide the reasons and explain the relevant complaint routes and the right to take the matter to court. Keep a record of the response and supporting decision.
The examples below illustrate how a request can involve more than one issue. The response depends on the information and circumstances.
A complaint about data handling is different from a request to exercise a right, even when both arrive in the same message.
Since 19 June 2026, new data protection complaints duties require organisations to provide a way for people to complain.
The ICO’s complaints guidance requires acknowledgement within 30 days, appropriate investigation, updates and an outcome without undue delay. The 30 days are an acknowledgement period, not a universal deadline for resolving the complaint.
If a complaint also contains a rights request, track both obligations. The ICO expressly distinguishes the two processes; acknowledging the complaint does not fulfil a request to access or correct information.
No. People can have rights over their information even when an organisation uses another lawful basis. For example, access and rectification are not dependent on consent. Some rights have narrower conditions: portability generally requires automated processing based on consent or a contract.
Requests are normally free. Article 12 permits a reasonable administrative fee, or refusal, for requests that are manifestly unfounded or excessive. These are specific legal tests. Inconvenience or staff time alone does not justify charging.
Yes. An ongoing dispute does not remove the right of access. The ICO confirms that an employer cannot refuse a SAR simply because the worker may use the information in litigation. Any exemption relied on must be assessed and justified for the particular request.
GDPR rights need to work through everyday processes. Managers should know how to recognise requests, record them and involve the person responsible for data protection. Those arrangements also depend on reliable records, access controls and other practical data protection measures.
Human Focus’s CPD-certified GDPR Awareness Training covers individual rights, the key data protection principles and responsibilities for handling personal information. It can support staff awareness alongside clear workplace procedures and specialist advice where needed.
