This page summarises the Data Protection Act 2018 , the UK’s data protection framework that sits alongside the UK GDPR. It explains the core principles, the main individual rights, and what to expect when you make a Subject Access Request (SAR).
1) The Data Protection Act 2018 in brief
The Data Protection Act 2018 (DPA 2018) provides the UK’s domestic rules that work with the UK GDPR. In practice, organisations that process personal data must handle it fairly, securely, and for proper purposes.
Data protection principles
The UK GDPR principles (reflected in how organisations must operate) require personal data to be:
- processed lawfully, fairly and transparently;
- collected for specified, explicit purposes;
- adequate, relevant and limited to what is necessary (data minimisation);
- accurate and kept up to date where needed;
- kept for no longer than necessary (storage limitation);
- kept secure (integrity and confidentiality); and
- accountable (the organisation must be able to demonstrate compliance).
ICO guidance on the principles is available here: ICO – Data protection principles.
Special category data
Additional safeguards apply to “special category” personal data, which can include:
- racial or ethnic origin;
- political opinions;
- religious or philosophical beliefs;
- trade union membership;
- genetic data;
- biometric data used to uniquely identify someone;
- health data; and
- sex life or sexual orientation.
Criminal offence data
Separate, stricter conditions apply to processing personal data relating to criminal convictions and offences. This is treated differently to standard personal data and generally requires an appropriate lawful basis and safeguards.
2) Your rights
Data protection law gives individuals rights over their personal data. Commonly referenced rights include:
- the right to be informed about how your data is used;
- the right of access (a Subject Access Request);
- the right to rectification (correct inaccurate data);
- the right to erasure (in some circumstances);
- the right to restrict processing (in some circumstances);
- the right to object (in some circumstances); and
- the right to data portability (where applicable).
You also have rights in relation to certain types of automated decision-making and profiling.
3) Finding out what data an organisation holds (SAR)
If you want a copy of the personal data an organisation holds about you, you can make a Subject Access Request. It can usually be made by email or letter. You should make clear you are requesting access to your personal data.
Time limits
Organisations must normally respond without undue delay and within one month. If the request is complex (or where there are multiple requests), they may extend by up to a further two months, but should tell you within the first month and explain why. ICO – guide to subject access.
When information may be withheld
There are exemptions that can limit what must be disclosed (for example where disclosure would prejudice certain investigations or other protected interests). Exemptions are fact-specific. Where an exemption applies, organisations may withhold information and may not always be able to provide full detail as to why.
If you need the ICO’s public guidance on response time limits and extensions: ICO – time limits for rights requests.
How much it costs
Most Subject Access Requests are free. In limited circumstances, an organisation can charge a reasonable fee or refuse a request if it is manifestly unfounded or excessive.
4) Complaints
If you believe your data has been mishandled, you should usually raise it with the organisation first and give them the opportunity to respond. If you remain dissatisfied, you can complain to the ICO: ICO – make a data protection complaint.
Contacting UK Bailiff Services Ltd
If your request relates to us, you can write to:
UK Bailiff Services Ltd
223 Bacup Road
Rawtenstall, Rossendale
BB4 7PA
ICO contact details
Information Commissioner’s Office (ICO)
Wycliffe House, Water Lane
Wilmslow, Cheshire, SK9 5AF
Telephone: 0303 123 1113
Relay UK (textphone): dial 18001
then 0303 123 1113
Hours: Mon–Fri, 9am–5pm
Further information
Please read our full Data Subject Access Request Policy for more detail on how we handle requests.
This content is provided for general information and is not legal advice.
