The Data Protection Act 2018, together with the UK GDPR, gives you real control over the data an operator holds on you, including, in many cases, the right to have it erased and the right to stop it being used for marketing.
Your right to erasure
You can ask an operator to delete the personal data it holds on you. A request can be made verbally or in writing, though putting it in writing and being clear about what you want removed gives you a record to rely on. The operator must normally respond within one calendar month, a period it can extend by up to two further months for complex or numerous requests, and it must explain its decision.
When an operator can refuse
Erasure is not absolute. An operator may need to keep certain records to meet its own legal and regulatory duties, for example anti-money-laundering obligations, where retention of five years is common under the Money Laundering Regulations 2017. Where it relies on that, it should tell you which data it is keeping and why.
You can ask. They must answer, and justify any refusal.
Stopping the marketing
Separate from erasure, you can object to your data being used for direct marketing, which an operator must then stop. If an operator ignores a valid request, you can complain to the Information Commissioner’s Office, which regulates these rights. The ICO can investigate and take action against an operator, but it does not award compensation; a claim for compensation would be a separate matter for the courts.
Further reading
- ICO, your right to get your data deleted (ico.org.uk).
- Data Protection Act 2018 (gov.uk/data-protection).
General information, not legal advice. Clinton & Co Advisors is a trading name of Ramays TA/Clinton and Co Limited. We are not solicitors or a law firm. We connect clients with regulated legal partners.