What rights does GDPR actually give you?
The UK GDPR and Data Protection Act 2018 give individuals a set of specific, enforceable rights over their personal data. They are more powerful than most people realise and cost nothing to exercise.
The rights:
The right of access. You can make a subject access request (SAR) requiring an organisation to tell you what personal data it holds about you, why, who it shares it with, and to give you a copy. It is free, must be answered within one month (extendable to three for complex requests), and can be made verbally or in writing to anyone in the organisation. You do not have to give a reason.
The right to rectification of inaccurate or incomplete data.
The right to erasure — the "right to be forgotten" — applying in defined circumstances, such as where data is no longer necessary or consent is withdrawn. It is not absolute, and is frequently overridden by legal obligations, public interest, or legal claims.
The right to restrict processing while accuracy is contested.
The right to data portability — receiving your data in a machine-readable format and having it transferred, where processing is based on consent or contract and is automated.
The right to object, including an absolute right to object to direct marketing — an organisation must stop immediately, with no balancing test.
Rights around automated decision-making, including a right not to be subject to solely automated decisions with legal or similarly significant effects, and to obtain human intervention.
How to enforce them. Complain to the organisation's data protection officer first. If unsatisfied, complain to the Information Commissioner's Office (ICO), which is free. You can also claim compensation through the courts for damage, including distress.
Practically: SARs are a genuinely useful tool in disputes, since they reveal what an organisation holds — including emails about you.