Bitesize has changed! We're updating subjects as fast as we can. Visit our new site to find Bitesize guides and clips - and tell us what you think!


Data Protection Act

The rights of data subjects

People whose personal data [data: information without context, eg a list of students with numbers beside their names is data, when it's made clear that those numbers represent their placing in a 100 metre race, the data becomes information ] is stored are called data subjects [data subject: anyone who has data stored about them that's outside their direct control ]. The DPA [Data Protection Act 1998 (DPA): legislation passed by parliament that governs the protection of personal data in the UK ] sets up rights for people who have data kept about them. You need to know these rights for the exam. They are:

  1. A Right of Subject Access

    A data subject has a right to be supplied by a data controller [data controller: a company or an individual that collects and stores data about people ] with the personal data held about him or her. The data controller can charge for this (usually around £10 pounds).

  2. A Right of Correction

    A data subject may force a data controller to correct any mistakes in the data held about them.

  3. A Right to Prevent Distress

    A data subject may prevent the use of information [information: data with context or meaning ] if it would be likely to cause them distress.

  4. A Right to Prevent Direct Marketing

    A data subject may stop their data being used in attempts to sell them things (eg by junk mail or cold calling.)

  5. A Right to Prevent Automatic Decisions

    A data subject may specify that they do not want a data user to make "automated" decisions about them where, through points scoring, a computer decides on, for example, a loan application.

  6. A Right of Complaint to the Information Commissioner

    A data subject can ask for the use of their personal data to be reviewed by the Information Commissioner [information commissioner: the individual responsible for enforcing the Data Protection Act ] who can enforce a ruling using the DPA. The Commissioner may inspect a controller's computers to help in the investigation.

  7. A Right to Compensation

    The data subject is entitled to use the law to get compensation for damage caused ("damages") if personal data about them is inaccurate, lost, or disclosed.


  1. These rights only practically exist if you know who has data stored about you.
  2. Some data controllers are exempt from the Act.

Back to The legal framework index

BBC © 2014 The BBC is not responsible for the content of external sites. Read more.

This page is best viewed in an up-to-date web browser with style sheets (CSS) enabled. While you will be able to view the content of this page in your current browser, you will not be able to get the full visual experience. Please consider upgrading your browser software or enabling style sheets (CSS) if you are able to do so.