- The law
- UK GDPR articles 12, 12A, 15 to 17 and 21, as amended by the Data (Use and Access) Act 2025
- Who enforces it
- Information Commissioner's Office (ICO)
- Penalties
- Up to £17.5 million or 4% of annual worldwide turnover, whichever is higher
What’s changed (2026/27 edition). Since 5 February 2026, the time limit is written into UK GDPR (the new Article 12A), with "stop the clock" rules for access requests.
What it means for your email
- A subscriber can ask for a copy of the data you hold about them (subject access), to correct it, to delete it, or to stop direct marketing.
- The ICO says you must respond "without undue delay and at the latest within one month of receiving the request".
- You can extend by up to two further months where the request is complex or the person has made several, but you must tell them, and why, within the first month.
- For a request for a copy of their data, the clock pauses while you wait for clarification you reasonably need. For any request, it doesn't start until you have any proof of identity you reasonably need.
- An objection to direct marketing is absolute: stop emailing them, whatever your lawful basis.
Do
- Give requests a reference number and a deadline the day they arrive, and say who owns them.
- Delete or export the person's data in your email platform, and check every other place email data lives (other lists, brands and platforms).
- Keep the minimum on a suppression list after deleting someone, so a future import doesn't add them back.
- Make a "reasonable and proportionate" search, as the ICO puts it, and keep a note of what you did.
Don't
- Don't ask for more identification than you need, or use it to delay.
- Don't keep emailing someone who has asked you to stop while you deal with the rest of their request.
- Don't put the person's details in tools that don't need them (Mailfois needs only your reference number).
Good to know
- Since the Data (Use and Access) Act 2025 changes came in on 5 February 2026, the time limit is set by the new Article 12A of UK GDPR, and the "stop the clock" rules for access requests are in law.
- Requests don't have to use special words or a form: an email or a reply to your newsletter can be a request.
Sources
- UK GDPR article 12 (legislation.gov.uk)
- Data (Use and Access) Act 2025, section 76 (legislation.gov.uk)
- A guide to subject access (ICO)
- Data Protection Act 2018, section 157: maximum fines (legislation.gov.uk)
- The PECR electronic mail marketing rules: "people have an absolute right to object" (ICO)
- Time limits for responding to data protection rights requests (ICO)
Researched by Mailfois · 2026/27 edition · checked 20 October 2026
Not legal advice. This is a plain-English summary. Check the sources for anything specific, or take professional advice. Spotted something out of date? Email [email protected] and we'll credit you if you'd like.