How a company uses your data
When you sign up to buy something online, join a mailing list, donate to a charity or enter a competition you are giving the organisation involved your personal data.
Depending on what permissions you give, that organisation might be able to:
- hold your data and use it for direct marketing, like email, post and phone calls
- sell your data to third parties
The Data Protection Act gives you rights you can use to manage your data and how companies can use it.
Section 11 Data Protection Notice
A Section 11 Data Protection Notice gives you the right to make a request to an organisation to stop processing your data for the purposes of direct marketing.
If you send this notice to an organisation, it means they must stop, or not begin, sending you marketing material or contacting you for marketing purposes.
Your request must be handled within a reasonable period.
The Information Commissioner’s Office (ICO) says this usually means emails, texts and calls will stop within 28 days of receiving the notice, and post will stop within two months.
Once the notice has been received they’re also no longer allowed to sell your data to third parties for marketing purposes.
If an organisation ignores your Section 11 notice you can make an application to the court to enforce it, or complain to the ICO.
When can I use the Data Protection Act?
You can use Section 11 of the Data Protection Act as an individual to put a stop to unwanted marketing, including junk mail, emails and nuisance calls.
But, there are usually steps you can take to stop direct marketing without resorting to a formal Section 11 notice.
- use our advice to stop unwanted calls
- use our advice to stop unwanted texts
- use our advice to stop unwanted junk mail
- use our advice to stop unwanted premium rate text messages
The first step you should take is to contact the organisation in question and ask to be removed from its marketing lists. This should be sufficient in most cases to stop unwanted marketing.
There are some companies who offer to handle Section 11 notices for you, but we recommend avoiding these as they may charge for the service when you can exercise your rights under Section 11 of the Data Protection Act for free.
You should know
- Using a Section 11 notice won’t stop junk mail addressed ‘to the occupier’ – only post which is addressed with your name.
- A Section 11 notice should stop email & phone calls though.
- Mailing Preference Service (MPS): Marketers have no legal duty to check the MPS before sending direct marketing, but most reputable organisations do so.
- Telephone Preference Service (TPS): Marketers legally can't make unsolicited sales calls to any number registered with the TPS. But registration with the TPS won't override any specific consents you may have given.
How do I use a Section 11 notice?
You need to give the organisation enough information to identify you. This may be your full name, address, email address or other information, such as a loyalty card number.
Your notice needs to be in writing. We recommend doing this via email, that way you'll automatically have a copy of your notice and proof of posting.
If you can’t find who to send it to, check the ICO register of data controllers.
You need to spell out that you're asking the organisation to stop (or not to begin) processing your personal data for direct marketing purposes in accordance with Section 11 of the Data Protection Act 1998.
Your notice should be dated and you should tell the organisation from what date you expect them to comply with your request.
In normal circumstances you can expect them to stop contacting you by email within 28 days of receiving your notice, and post to stop within two months.
Stop unwanted direct marketing, use our template letter to create a Section 11 notice.
Section 7 Subject Access Request
A Section 7 Subject Access Request gives you the right to request information about the personal data that an organisation holds about you.
A subject access request allows you to find out what data an organisation has about you and how they use it.
But you don’t have an automatic right to see the documents in which that data is held.
You can also obtain details of how the organisation received such personal data and a description of who they disclosed personal data to.
But it's not a legal right to be told the names of organisations or people to whom they have disclosed your data.
Subject access requests have limited use if you are seeking to stop unwanted direct marketing, as Section 7 gives you the right to find out if an organisation holds your personal data but not to stop them from using it.
You can also find out if your data has been passed on to other organisations, but you may not be able to identify the specific organisations.
You can find out more about making subject access requests on the ICO's website.