Subject access requests. Rights to erasure. Data portability. Rights to restriction. These are the obligations that sit on the other side of the GDPR framework from lawful basis and consent — the rights that individuals can exercise over the data firms hold about them, and the corresponding obligations on firms to respond.
In earlier pieces in this series, we covered the GDPR obligations that arise when crypto firms collect and use data — onboarding and KYC processing, direct marketing consent, and automated decision-making. This piece covers what happens when a customer asks a firm to do something about their data: to show them what is held, to delete it, to stop using it, or to give it to them in a format they can use elsewhere.
These are not abstract rights. They are exercised by customers — increasingly by customers who have had a negative experience, customers who are in dispute, and customers who are seeking to understand what information a firm holds before they proceed with a complaint. The ICO’s enforcement record on data subject rights shows that poor handling — slow responses, incomplete responses, unjustified refusals — is an area of active investigation.
The Rights That Apply and When
UK GDPR gives individuals several rights over their personal data. For crypto firms, the most frequently exercised are:
The right of access (Article 15) — subject access requests. An individual has the right to obtain confirmation of whether their personal data is being processed and, if so, access to a copy of that data along with supplementary information including the purposes of processing, the categories of data, any third parties with whom the data has been shared, and the retention period. The response must be provided within one month of receipt of the request, free of charge.
The right to erasure (Article 17) — the right to be forgotten. An individual has the right to request deletion of their personal data where it is no longer necessary for the purpose for which it was collected, where consent has been withdrawn and there is no other lawful basis, or where the data has been unlawfully processed. The right is not absolute — it is subject to exceptions including legal obligations that require retention. For crypto firms, the most common exception is the MLR five-year retention obligation.
The right to data portability (Article 20). An individual has the right to receive their personal data in a structured, commonly used, and machine-readable format and to transmit it to another controller, where the processing is based on consent or contract and is carried out by automated means. For crypto firms, this is most relevant to customers seeking to move their account or trading history to another platform.
The right to restriction (Article 18). An individual has the right to request that processing is restricted — for example, while a complaint about accuracy is being resolved, or where the individual has objected to processing.
The right to object (Article 21). An individual has the absolute right to object to processing based on legitimate interests, including for direct marketing purposes. The objection must be acted on immediately for direct marketing and the individual must be removed from the marketing list without delay.
Where Crypto Firms Are Most Exposed
Subject access requests in a multi-system environment. A crypto firm typically holds customer data across multiple systems — the core platform, the CRM, customer support tools, compliance and AML systems, marketing platforms, and potentially third-party providers including KYC verification services. A complete response to a subject access request requires the firm to identify and retrieve all personal data held across all of these systems within the one-month deadline.
Most firms have not mapped their data across systems in a way that makes SAR fulfilment straightforward. When a SAR arrives, the response process involves manually contacting each system owner, waiting for data extracts, and compiling a complete picture — a process that frequently takes longer than one month and produces incomplete results.
The ICO’s enforcement focus on SARs is primarily on timeliness and completeness. A response provided after the deadline, or a response that omits data held in a system the firm forgot to check, are both breaches.
The erasure-retention tension. The most common erasure request scenario in crypto is a customer who has closed their account and wants their data deleted. The firm’s obligation is to delete data that it no longer has a lawful basis to retain — but the MLR five-year retention obligation means that the core KYC and transaction data must be retained regardless of the customer’s request.
The correct response to an erasure request in this scenario is not refusal — it is partial compliance. The firm should identify which data it is required to retain under its legal obligations, retain only that data, delete everything else, and explain to the customer which data is being retained, on what basis, and for how long. Many firms respond to erasure requests with a blanket refusal citing MLR obligations, without assessing which data is actually covered by those obligations and which is not.
Portability in practice. The right to portability requires the firm to provide data in a structured, commonly used, machine-readable format. For trading history and account data, this typically means CSV or JSON exports. Many firms’ platforms do not have built-in data export functionality in a format that meets the portability standard — customers receive a PDF statement rather than a machine-readable data export.
The one-month deadline. The ICO enforces the one-month response deadline strictly. Extensions are available — up to two further months where the request is complex or numerous — but the extension must be notified to the individual within one month of the request, with reasons. Firms that simply fail to respond within a month are in breach regardless of the quality of the eventual response.
Worth asking:
If a subject access request arrived from a customer tomorrow — asking for all personal data your firm holds about them — do you have a documented process for identifying that data across every system, compiling a complete response, and delivering it within one month?
The ICO’s Enforcement Pattern on Data Subject Rights
The ICO’s enforcement activity on data subject rights in financial services has been increasing year-on-year. The most common triggers for investigation are: a complaint from an individual who did not receive a response within one month; a complaint from an individual who received what they believe is an incomplete response; and a complaint from an individual whose erasure request was refused without adequate explanation.
The ICO takes a particularly serious view of firms that have no documented SAR process — where requests are handled ad hoc, without a defined workflow, assigned owner, or response timeline. The absence of a process is treated as evidence of systemic non-compliance rather than an isolated failing.
Monetary penalties in financial services data subject rights cases have ranged from tens of thousands to hundreds of thousands of pounds, depending on the scale of the breach, the number of individuals affected, and the firm’s response to the ICO’s investigation.
Building a Functioning Data Subject Rights Framework
For crypto firms that have not systematically addressed data subject rights, the starting point is a data mapping exercise — identifying what personal data is held, where it sits, who is responsible for each system, and what the legal basis and retention period is for each category of data.
From that mapping, a data subject rights framework should cover:
A documented SAR process. A clear workflow from receipt of a SAR to delivery of the response — who receives the request, who coordinates the response across systems, who quality-checks the response, who communicates with the individual, and what the internal deadline is to allow for the external deadline to be met comfortably.
A data map that supports SAR fulfilment. A current record of every system in which customer personal data is held, updated when new systems are added, that enables the SAR coordinator to ensure the response is complete.
An erasure decision framework. A documented process for assessing erasure requests — identifying which data is subject to legal retention obligations, which is not, what the firm will delete, what it will retain, and how it will communicate its decision to the individual.
A portability format. A defined format for data portability responses that meets the machine-readable standard — not a PDF statement, but a structured data export that the individual can use with another service.
A rights request log. A record of all data subject rights requests received, the date of receipt, the response provided, and the date of response. This is part of the UK GDPR accountability obligation and is what the ICO will ask to see if it investigates.
Final Thought
Data subject rights are a live operational obligation — not a theoretical framework that sits in the privacy notice. The ICO’s enforcement record shows that the gap between having a privacy notice that describes the rights and having the operational capability to respond to their exercise is where most firms’ exposure sits.
For crypto firms managing multiple GDPR obligations simultaneously, the practical solution is a GDPR framework that covers all of them in an integrated, maintained, and evidenced way.
If you want to assess your data subject rights framework against the ICO’s current standard, speak to our team.
Book a free consultation
We help crypto and fintech firms build GDPR data subject rights frameworks that meet the ICO’s operational standard — SAR processes, erasure frameworks, portability capability and rights request logging.
Email: info@lhiconsult.com | Phone: +44 203 319 5147 | Web: lhiconsult.com
Contact LHI Consulting for a free 30-minute consultation.
This article is for general information purposes only and does not constitute legal or regulatory advice. LHI Consulting is a trading style of LHI Holdings Ltd, registered in England and Wales, No. 11496647.
FAQs
How long does a firm have to respond to a subject access request?
One calendar month from the date of receipt. Where the request is complex or there are numerous requests, the firm may extend the deadline by up to two further months — but must notify the individual of the extension within the original one-month period, with reasons for the delay.
A customer has requested erasure but we need to keep their data for AML purposes. How do we respond?
Conduct a data mapping exercise to identify which specific data you are legally required to retain under the Money Laundering Regulations and for how long. Delete all data that is not covered by the MLR retention obligation, retain only what is required, and inform the customer of which data is being retained, on what legal basis, and for what period. A blanket refusal without this analysis is not a compliant response.
Does the right to portability apply to all customer data?
No. The right to portability applies only to data that the individual provided to the firm, where the processing is based on consent or contract, and where the processing is carried out by automated means. It does not apply to data generated by the firm — for example, internal risk scores or compliance notes — or to data processed on the basis of legal obligation or legitimate interests.
We receive very few subject access requests. Do we still need a documented SAR process?
Yes. The ICO’s accountability principle requires firms to be able to demonstrate that they have appropriate processes in place for managing data subject rights — regardless of how frequently those rights are exercised. The absence of a documented process is treated by the ICO as a systemic compliance gap.
Can we charge for responding to subject access requests?
In most cases, no. UK GDPR requires that SARs be responded to free of charge. The only exception is where a request is manifestly unfounded or excessive — in which case the firm can charge a reasonable fee or refuse to act on the request. The bar for manifestly unfounded or excessive is high, and firms should take legal advice before refusing or charging for a SAR response.