Data Protection Act 2025, rights of a data subject

Data Protection Act 2025, ss. 13, 15-17 (information notice and rights of data subjects)

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

Commencement not set.

A data subject rights rule binding public and private bodies.

As of 19 September 2026.

What it requires

This Act is enacted but not in force: section 2 leaves commencement to a ministerial notice, and none was located as of this review, so a data subject's rights and the information notice duty do not bind anyone yet.
On commencement, tell a data subject before collecting their personal data who the controller is and how to contact them, the purpose of the processing, how to exercise their Part IV rights, and how to lodge a complaint with the Digital Transformation Office, and give that information as soon as possible afterward where it could not be given beforehand.
On commencement, give a data subject, at no expense and without unreasonable delay, confirmation of whether their personal data is being processed and its source, a copy of it in a commonly used electronic format, correction of data that is inaccurate, out of date, incomplete or misleading, and deletion of data the controller is not entitled to retain.
On commencement, let a data subject withdraw consent previously given, or object to processing that rests on voluntary provision with no lawful basis, as easily as they gave it, tell them the consequences of doing so, and promptly stop the processing that relied solely on it.
On commencement, do not subject a data subject to a decision based solely on automated processing of personal data that produces a legal or similarly significant effect on them, unless the decision is necessary to a contract with them, authorised by a law with suitable safeguards, or authorised by their consent.
On commencement, a manifestly unfounded or excessive request, particularly one that is repetitive, may be met with a reasonable fee or a refusal, and a fee for a copy of personal data may be charged only to the extent another law otherwise permits it.

What it reaches

Obligation class

Data subject rights, Disclosure, Access restriction

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Section 13 requires a controller to tell a data subject, before collecting personal data from them, the controller's identity and contact details, the purpose of the processing, how to exercise the Part IV rights, and how to lodge a complaint with the Office under section 26, and to give that information as soon as possible afterward if it could not be given at collection.

Section 15 gives a data subject the right to obtain from a controller, at no expense and without unreasonable delay, confirmation of whether the controller is processing their personal data, a copy of it in a commonly used electronic format, correction of data that is inaccurate, out of date, incomplete or misleading, and deletion of data the controller is not entitled to retain.

Section 15(2) lets a controller charge a reasonable fee or refuse a request that is manifestly unfounded or excessive, particularly because of its repetitive character, and section 15(4) lets a controller charge a fee for a copy of personal data only to the extent another applicable law otherwise permits.

Section 16 gives a data subject the right to withdraw consent previously given, or to object where no lawful basis applies, requires a controller to make exercising that right as easy as giving consent, and requires the controller to promptly stop processing that relies solely on the withdrawn consent.

Section 17 gives a data subject the right not to be subject to a decision based solely on automated processing of personal data that produces a legal or similarly significant effect on them, except where the decision is necessary to a contract with the data subject, authorised by a law with suitable safeguards, or authorised by the data subject's consent.

When LexLint raises it

crawls_web
trains_models
deploys_chatbot
automated_outreach
high_risk_decisions
generates_content

Read the law

Act text as published by the Ministry of Information, Communications and Transport (Data Protection Act 2025).

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app