Reform UK Faces Representative GDPR Claim Over Ignored Data Subject Access Requests

The Reform UK Party failed to respond to Data Subject Access Requests (DSARs) and other data processing notices submitted by over 1,700 individuals, violating a fundamental obligation under UK GDPR Article 15. Organisations must respond to DSARs within 30 days, and systematic non-compliance signals a broader failure in data governance and accountability processes. This case demonstrates that ignoring data subject rights is not a low-risk oversight — it can trigger large-scale representative legal actions and significant reputational damage. The High Court's refusal to strike out the claim signals that courts will allow collective GDPR enforcement mechanisms to proceed, raising the legal and financial stakes for non-compliant organisations.

Tactical Insight

Immediate actions

Establish a dedicated DSAR intake process with a tracked ticketing system to ensure every request is logged and assigned an owner on receipt.
Audit all outstanding data subject requests immediately to identify any breaches of the statutory 30-day response window.
Appoint or confirm a Data Protection Officer (or responsible lead) with clear authority to enforce DSAR deadlines.

Long-term improvements

Implement a DSAR workflow tool or CRM module that automatically triggers escalation alerts as the 30-day deadline approaches.
Develop and regularly train staff on a Data Subject Rights Policy covering DSARs, erasure, objection, and rectification requests.
Conduct annual data protection compliance audits aligned to UK GDPR obligations, including third-party processors.

Detection & monitoring measures

Maintain a centralised register of all data subject requests, recording receipt date, response date, and outcome for audit trail purposes.
Set up automated monitoring dashboards to flag any request approaching or exceeding the legal response deadline.
Review complaint and request volumes periodically to identify systemic gaps in data rights fulfilment processes.