Guides › Money, Scams and Insurance › Data Protection and Privacy
Data Protection and Privacy
You have the right to see the personal information organisations hold about you, to have it kept safe, and to stop marketing. If an organisation does not put things right, you can complain to the Information Commissioner's Office (ICO), the UK data protection regulator.
At a Glance
Your Rights
What the rules say, with a link to the official source for each.
Your Data
Getting a Copy of Your Data
You can ask an organisation for a copy of the personal information it holds about you (a subject access request). It should respond within one calendar month. If it does not, follow up, then complain to the organisation. source
Data Breaches
If your data is caught up in a breach, ask the organisation what happened and what information was affected. Use strong passwords and multifactor authentication, and watch for suspicious calls, emails and texts. source
Complaining to the ICO
Give the organisation a chance to respond first. You can then complain to the ICO; for data requests, do this within three months of your last meaningful contact with the organisation. source
Marketing and Calls
Marketing Emails
Organisations can only send marketing emails in set circumstances, such as when you opted in, and must stop once you opt out. If they carry on, you can complain to the ICO. source
Nuisance Calls and Texts
Register free with the Telephone Preference Service to cut marketing calls; it can take up to 28 days. Report nuisance marketing calls to the ICO, silent calls to Ofcom, and forward unwanted texts to 7726 for free. source
Credit Files
Your Free Credit Report
You can get a free statutory copy of your credit file from each of the three main credit reference agencies; you do not need a paid subscription. The agency generally has one month to respond. source
Fixing Mistakes
Raise mistakes with the credit reference agency, and the lender if it supplied the wrong information. You can add a Notice of Correction. If neither fixes an obvious inaccuracy, you can complain to the ICO, though it does not decide financial disputes. source
Time Limits to Know
Miss a deadline and you can lose a right. Check the dates on your own paperwork.
- See belowOrganisation responds to your data requestOne calendar month
- 3 monthsComplain to the ICO about a data requestWithin three months of your last meaningful contact
- 1 monthCredit reference agency respondsGenerally one month
- 28 daysTelephone Preference Service takes effectUp to 28 days
Where to Go If It Is Not Put Right
Free routes to escalate, and when each one applies.
The Organisation
Always start here, in writing.
Information Commissioner's Office (ICO)
If the organisation does not put things right.
Telephone Preference Service
To reduce marketing calls. Free.
Steps to Take
Step 1 of 5
Write to the organisation, saying what you want: a copy of your data, a correction, or to stop marketing.
Step 2 of 5
Keep a copy and note the date.
Step 3 of 5
Follow up if there is no reply after one calendar month.
Step 4 of 5
Make a formal complaint to the organisation.
Step 5 of 5
Complain to the ICO, within three months of your last meaningful contact for data requests.
(Tap the numbers to reveal steps)
Evidence and Your Letter
Gather your evidence, then build a letter you can send in minutes.
Evidence Checklist
0 of 5 gatheredTap each one when you have it.
CPUKLetter Generator
How This Works
- 1
Tick off the evidence you already have, and see what is still missing.
- 2
Answer the letter questions. Your answers fill in the wording for you.
- 3
Copy or download the letter, check every detail, and send it yourself.
A template, not legal advice.
Watch Out For
Common traps and scams to avoid.
Paid credit report subscriptions you did not need: the statutory report is free.
Scammers contacting breach victims pretending to help.
Unsubscribe links in scam emails: only unsubscribe from genuine senders.
Recent or changing rules: tap to read
Checked 13 October 2026, using ICO and Ofcom pages already checked for our problem guides.
Common Problems
Step-by-step help for a specific problem covered by this guide.
Want Help?
If you would like one of our team to look at your problem, our initial case review is free. We cannot guarantee any outcome and we do not give legal advice.
Not sure where you stand? Try our action plan tool or the free letter templates.
Sources and official links
- ico.org.uk/for-the-public/getting-copies-of-your-information-subject-access-requ Checked 13 October 2026
- ico.org.uk/for-the-public/i-m-worried-an-organisation-hasn-t-kept-my-information Checked 13 October 2026
- ico.org.uk/for-the-public/online/spam-emails/ Checked 13 October 2026
- ofcom.org.uk/phones-and-broadband/scam-calls-and-messages/unwanted-calls-texts-a Checked 13 October 2026
- ico.org.uk/for-the-public/credit/ Checked 13 October 2026
Lead reviewer
Luke Marley
Founder and Lead Reviewer
Luke founded CPUK in 2026 after seeing how hard it is for ordinary people to get problems with companies put right. He oversees our guides and checks them against official sources.
Research by Katie Burt, Co-founder and Operations Lead (17 years in the care sector, including managing services for vulnerable adults), and the CPUK Research Team. Researched with AI-assisted research tools, then checked and corrected by our team.
Last checked: 13 October 2026. We are not paid by the companies we write about. Adverts never affect our guidance. Read our editorial policy.