Rights of Individuals
The sixth data protection principle requires a data controller to process personal data in accordance with the rights of individuals.
There are specific occasions when these rights do not apply or are limited in their extent.
As the right of access to personal data is the most frequently exercised right, further detail on complying with subject access requests is available.
If an individual believes that an organisation has failed to process their personal data in accordance with their rights (such as failing to comply with a subject access request) they can make a complaint to the Commissioner and exercise their right to seek compensation from the data controller.