Digital Rights questions
5 direct answers, each with the short version first and a link to the full guide. For the whole topic, see Digital Rights.
How long does a company have to respond to a subject access request?
One calendar month, starting the day after they receive it, and it must be free. That can be extended by up to two further months for complex or numerous requests — but only if they tell you why within the first month. No notice, no valid extension.
Can I get Google to remove search results about me?
Sometimes. De-indexing is an application of the UK GDPR right to erasure, and Google and Bing both run UK request forms. Success depends on balancing your privacy against the public interest — outdated, inaccurate or disproportionately damaging material about a private individual has the best chance.
Can I claim compensation for a data breach?
Yes — under Article 82 of UK GDPR, for financial loss and for distress. But you claim in the county court, not from the ICO: regulator fines go to the government, not to you. You must show the breach, the damage, and a causal link between them.
How do I get a defamatory post removed from a website?
Send the website operator a notice of complaint under the Defamation Act 2013. They then have 48 hours to remove the content or pass your notice to the poster, who has five days to respond. If the poster stays silent or cannot be identified, the operator must remove it.
Do I have to accept cookies on a website?
No. Only strictly necessary cookies can be set without your consent — everything else, including analytics and advertising, needs it. A “reject all” option must be as easy to find and use as “accept all”, and it must sit on the first layer of the banner.