The Data Protection Act of 2018 & The UK GDPR

All data subjects have a right to request rectification of any collected data if it has become outdated/incorrect/obsolete since the data was initially collected. In case of incomplete data, the data subjects will have the right to provide a supplementary statement to complete such incomplete data.

Also known as the Right to be Forgotten, all data subjects have the right to request any collected on them be destroyed, and any existing data processing activities be ceased accordingly.

The data processor/controller must abide by any such requests if any of the following criteria are met:

• Data collected is no longer necessary for the purpose they were collected;
• The data subject has withdrawn their consent to data collection;
• The data subject has objected to data collection;
• Data was unlawfully processed;
• Data has to be erased pursuant to a legal obligation in a state where the data controller is a subject.

All data subjects have the right to receive all data collected on them by a data processor or controller in a structured, commonly used, and machine-readable format that can be accessed easily via an appropriate electronic device.

All data subjects have the right to request an end to all data collection and processing activities related to their data. The data processor/controller must cease all their data collection activities once such a request is made unless they have legitimate reasons for continuing to do so related to legal, contractual, and national security reasons. The right to object includes the right to withdraw consent for direct marketing purposes.

All data subjects have the right to request a restriction on the processing or collection of their personal data in the following circumstances:

• The data subject contests the accuracy of the data collected;
• Data was unlawfully processed and the data subject requests the restriction of data processing rather than erasure of data;
• The data controller no longer needs to process the data;
• The data subject has objected to their data being processed and verification is pending.

All data subjects have a right to request an end to any automated decision-making, including profiling that may have legal implications for the data subject.

However, this right does not apply in the following cases:

• The data subject has explicitly consented to automated decision making;
• The state permits the data controller to carry out such activities;
• Automated decision-making is necessary for the performance of a contract between the data subject and the data controller.