The Data Protection Act 2018 gives individuals rights relating to the processing of their personal information, which are:

1. Right to be informed – obligation to provide ‘fair processing information’ through privacy notices. There must be transparency at the point of collection on how the information will be used and there is an emphasis on providing you with a clear and concise notice. 
2. Right of access – individuals must be able to access their data to ensure that it is being processed lawfully. This is commonly referred to as a Subject Access Request. If you wish to have access to your personal data you can submit a request in writing, email or verbally and the company will respond within 28 days. We may seek clarification as to your identity before proceeding and importantly there is no fee for this service.  Where personal data is transferred to a third country or to an international organisation, the data subject shall have the right to be informed of the appropriate safeguards in place relating to the transfer.
3. Right to rectification – GDPR includes a right for individuals to have inaccurate personal data rectified or completed if it is incomplete. This right is closely linked to the controller’s obligations under the accuracy principle, article (5)(1)(d). An individual can make a request for rectification verbally or in writing, in certain circumstances this request can be refused. A response should be actioned within one month of the request.
4. Right to be forgotten (is not absolute and only applies in certain circumstances) erasure or rectification of personal data – the data subject has the right for the controller to erase all personal data concerning the data subject without undue delay where the following apply; personal data is no longer necessary in relation to the original purpose for processing; data subject withdraws consent; data subject objects to processing and lawful basis for original processing was under legitimate interest; the personal data was unlawfully processed; personal data needs to be erased due to legal obligations.
5. Right to Restrict processing – Individuals have the right to request the restriction or suppression of their personal data, this is not an absolute right and only applies in certain circumstances. An individual can make the request verbally or in writing and the request needs to be actioned within one calendar month. When processing is restricted you care permitted to store the personal data, but not use it.
6. Right to data portability – this is a new right enabling individuals to reuse and transfer their personal data (held in electronic format only and carried out by automated means) for their personal use to another data controller without hindrance or affecting its usability. This right is however only applicable when personal information is captured under the lawful basis of consent or performance of a contract. This right will not apply to processing necessary for the performance carried out in the public interest.
7. Right to object – the data subject shall have the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her which is based on points (e) public interest or (f) legitimate interest of article 6(1), including profiling based on these provisions. The controller shall no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.