UK GDPR

Withdraw consent to processing at any time, as easily as it was given, without affecting the lawfulness of processing carried out before the withdrawal.

Confirm whether your personal data is processed and get access to it and a copy of it, limited to what the controller can find through a reasonable and proportionate search.

Obtain the purposes of the processing, the categories of personal data, the recipients or categories of recipient, the envisaged retention period and any available information on the source, as far as a reasonable and proportionate search allows.

Have inaccurate personal data corrected without undue delay and incomplete data completed, including by providing a supplementary statement.

Have personal data erased without undue delay when, for example, it is no longer needed, consent is withdrawn, an objection succeeds or it was processed unlawfully, subject to the exceptions in Article 17(3).

Have processing limited, in general to storage, while accuracy is contested, where processing is unlawful but you oppose erasure, where the controller no longer needs the data but you need it for legal claims, or while an objection is assessed.

Receive the personal data you provided in a structured, commonly used, machine-readable format and transmit it to another controller, directly where technically feasible, where processing is automated and based on consent or contract.

Object, on grounds relating to your particular situation, to processing based on public task, recognised legitimate interests or legitimate interests, including profiling, unless the controller shows compelling legitimate grounds that override your interests or needs the data for legal claims.

Object at any time to processing for direct marketing, including related profiling, after which the data may no longer be used for that purpose.

When a significant decision about you is made solely by automated processing, get information about it, make representations, obtain human intervention and contest it; it may not rely on recognised legitimate interests, and may use special category data only with explicit consent or on the grounds in Article 22B(3).

Complain to the controller about a suspected infringement of the UK GDPR; the controller must offer a complaint channel such as an electronic form, acknowledge receipt within 30 days and respond without undue delay.