ICO Guidance on Individual Rights and GDPR
Summary
The UK's Information Commissioner's Office (ICO) has updated its guidance on individual rights under GDPR. This update is in anticipation of the Data (Use and Access) Act 2025 and indicates that further changes may occur. The guidance is primarily aimed at large businesses.
What changed
The Information Commissioner's Office (ICO) has issued updated guidance concerning individual rights under the UK GDPR. This guidance is currently under review due to the upcoming Data (Use and Access) Act 2025, with potential for further revisions. The document provides detailed information on privacy notices, subject access requests (SARs), the right to be informed, automated decision-making, and profiling, alongside resources for businesses.
While this guidance is non-binding, it outlines best practices for compliance with data protection regulations. Organisations, particularly large businesses in the public, private, and third sectors, should review this guidance to ensure their data handling practices align with current and anticipated requirements. Small businesses are directed to separate resources. The ICO has indicated that this guidance may be subject to change as legislative developments occur.
Source document (simplified)
Individual rights - guidance and resources
- Due to the Data (Use and Access) Act coming into law on 19 June 2025, this guidance is under review and may be subject to change. The Plans for new and updated guidance page will tell you about which guidance will be updated and when this will happen. The guidance on this page is suitable for large businesses in the public, private and third sectors. Small businesses should use the resources on our small business web hub.
Brief guidance
A guide to individual rights
Brief guidance covering privacy notices, subject access requests, deleting and changing information, stopping and restricting processing, moving information and making automated decisions about people.
Detailed guidance
The right to be informed (privacy notices)
When, how and what should you tell people about how their information is used.
The right of access (subject access requests)
What is a subject access request (SAR), how to recognise them, when and how to respond to them and how to manage health, social work and education information in relation to SARs.
Automated decision-making and profiling
What is automated individual decision-making and profiling, what does the UK GDPR say about when and how you can carry out automated decision-making.
Resources
Better records together - our care records standards
Care records standards for organisations that hold or create care records and respond to requests for access to those records
Find Subject Access Request (SAR) resources
A quick reference guide to help you find the content you need on each subject access request topic.
Training videos: individual rights
Recordings of ICO staff training on the data protection principles, available for you to reuse.
Help us improve our website
Was this page helpful? (optional) Yes No
Related changes
Source
Classification
Who this affects
Taxonomy
Browse Categories
Get Government alerts
Weekly digest. AI-summarized, no noise.
Free. Unsubscribe anytime.
Get alerts for this source
We'll email you when ICO GDPR Guidance publishes new changes.