The law that applies
UK General Data Protection Regulation (UK GDPR)
The primary framework for data protection rights in the UK post-Brexit. Right to access, erasure, rectification, restriction of processing, and data portability.
Data Protection Act 2018
Implements UK GDPR in UK statute. Applies to all UK-established organisations processing personal data.
Privacy and Electronic Communications Regulations 2003 (PECR)
Prohibits unsolicited marketing calls, texts, and emails without prior consent or a soft opt-in. Companies can be fined by the ICO up to £500,000.
The process - step by step
Letter to the company's Data Protection Officer (DPO)
Formally assert your right - to erasure, to stop processing, for a SAR, or for nuisance call compensation. Cite UK GDPR and PECR as applicable.
Report to the ICO
If the company ignores or refuses, report to the Information Commissioner's Office. The ICO can investigate, issue enforcement notices, and levy significant fines.
Civil compensation claim
UK GDPR Article 82 gives you the right to compensation for material or non-material damage caused by a data breach or unlawful processing.
Possible next steps
Information Commissioner's Office (ICO)
The ICO is free to contact and can fine organisations up to £17.5 million or 4% of global turnover (whichever is higher). ICO reports are taken seriously by companies with brand reputations to protect.
This is general guidance only. Whether an external scheme applies depends on the company, its membership, the complaint stage, and verified case facts. Fight My Corner does not currently start an external route.
Important warnings
If a company called or texted you without your consent, you may be entitled to compensation - flag this prominently in your letter.
Subject Access Requests must be answered within one calendar month. Failure is a breach you can report to the ICO.
The Right to Erasure ('right to be forgotten') is not absolute - it doesn't override legitimate legal or contractual grounds for keeping data.
Tips & practical advice
Always ask the company to confirm in writing whether they hold your data and on what legal basis - this forms the foundation of your challenge.
What Fight My Corner covers for this dispute
What's included
- Subject Access Request (SAR) letters and follow-ups
- Right to erasure (right to be forgotten) requests
- Nuisance call / marketing consent challenges
- Compensation requests for unlawful data processing
What's not included
- Complex class action data breach claims
- Criminal data theft (report to Action Fraud and police)
Start your fact-checking intake
Tell us what happened with data protection & nuisance calls. We'll save the facts you confirm and check the company classification. No letter is generated at this stage.
Legal disclaimer · Fight My Corner provides dispute guidance, not legal advice.