Under the UK GDPR, an individual can ask someone else to act for them. The ICO’s guidance is clear that a subject access request can be made on a person’s behalf by a relative, a solicitor or an online service, provided the organisation is satisfied that the third party has authority. Proving that authority is the third party’s job.
That works for one-off requests. It works less well for a business that acts for thousands of people at once. The legislation expressly allows some rights to be delegated, such as complaining to the Information Commissioner or bringing a claim. It says nothing explicit about delegating the core rights in Chapter III: access, rectification, erasure, objection and, most importantly, portability. Controllers cite that silence when they refuse requests from intermediaries.
The 2026 consultation
The Department for Science, Innovation and Technology consulted on this between 8 June and 31 August 2026. The options included amending the UK GDPR to confirm that rights can be delegated, aligning with the EU regime, creating an authorisation scheme for intermediaries, and requiring the largest platforms to offer portability interfaces. The government also named the risks: coerced delegation, concentration of data in a few intermediaries, and extra cost for controllers. At the time of writing, no response has been published.
What this means now
Authority has to be provable. A mandate should be specific about which rights it covers, recent, verifiable and easy to revoke.
Expect friction. Controllers may verify identity and may contact the individual directly. The ICO says a controller does not have to sign up to a portal or pay a fee to read a request.
A model that only works if the law changes is a bet. A model that works under today’s agency principles, and improves with reform, is a business.
This article is general information on the law as at October 2026. It is not legal advice and has not been updated since that date. See the terms of use.