Your data in the UK: getting off marketing lists

Last checked: 28 Sep 2026; links rechecked 12 Oct 2026; right to object and complaints (12 Oct 2026) added here 6 Nov 2026

Most UK marketing lists and people-search sites start from the same few sources, above all the open electoral register. Opting out at the source first, then at each company, stops your details being copied back in.

In this order

Opt out of the open register: free, through your council, and it doesn't affect your vote.
Opt out of the credit agencies' marketing services: Experian, TransUnion, Equifax, plus Sagacity and Acxiom. This is separate from your credit file.
Remove your details from people-search sites: 192.com, ukphonebook, the phone book and Findmypast.
Remove your home address from Companies House: if you're a company director and your home address is on old filings.
Register with the preference services below, for calls and post. For post, see how to stop junk mail; for calls, how to stop unwanted sales calls.

Preference services

Service	What it covers	What it doesn't
Telephone Preference Service	Unsolicited live sales and marketing calls, to landlines and mobiles. Free; you can also register by texting "TPS" and your email address to 85095.	Companies you agreed could call you before you registered: opt out with them directly.
Mailing Preference Service	Unwanted addressed direct mail. Free; can take up to three months to take full effect.	Overseas mail, unaddressed mail, post to "The Occupier", or mail from companies you've already done business with.
Fundraising Preference Service	Direct marketing from named charities registered in England, Wales and Northern Ireland. Up to 21 days to take effect.	Charities registered in Scotland, door-to-door or street fundraising, and charity bags.
Royal Mail Door to Door opt-out	Unaddressed items delivered by Royal Mail. Paper form; lasts two years.	Addressed mail, including "To the Occupier", and leaflets from other distributors.

Your rights at a glance

UK data protection law gives you these rights over any organisation that holds your data. You can use them verbally or in writing; the regulator recommends writing, so you have a record, and there's no required wording.

Right	When it applies	Can they refuse?	Time limit	Template
Object to direct marketing	Any use of your data for direct marketing, including profiling for marketing	No. They can keep you on a suppression list so they know not to market to you	One calendar month; up to two more for complex requests, if they tell you why	Regulator's letter
Object to other uses	Where the organisation relies on its "legitimate interests"	Yes, if it has strong reasons to carry on, or a legal or contractual need	One calendar month, as above	Regulator's letter
Get your data deleted	Specific situations, including after you've objected to direct marketing	Yes, for specific reasons, such as a legal obligation to keep it	One calendar month; up to two more if they tell you within the first month	Regulator's letter
See what they hold (subject access request)	Any organisation that holds your data	All or part, if the request is manifestly unfounded or excessive	Usually one month; up to two more if complex	Regulator's free service
Complain to the organisation	It ignores your request, or you're unhappy with its answer	n/a	Must acknowledge within 30 days (since 19 June 2026); no fixed deadline for the outcome	Regulator's template
Complain to the regulator	After giving the organisation a chance to finish its own process	n/a	Complaints needing closer examination currently reach a case officer around 10 months after submission	Online form

Object to direct marketing

For direct marketing, the regulator (the Information Commission, still the ICO on its website) says organisations cannot refuse. That makes it the simplest way to get off a marketing list.

Find the organisation's contact for data requests, usually in its privacy notice (sometimes a data protection officer's email address or a web form).
Say you object to the use of your personal data for direct marketing, including any profiling for marketing. Give enough detail for them to find you, such as your name and address.
Use the regulator's template letter if it helps: it's on the right to object page.
Keep a copy and note the date you sent it.

The organisation should respond within one calendar month. Keeping your name on a suppression list is expected, not a refusal. If it doesn't comply, complain.

Other uses. You can also object where an organisation relies on its "legitimate interests". Unlike direct marketing, the organisation can refuse those objections if it has strong reasons to carry on, or a legal or contractual need. You can't object where the data is needed for a contract with you, a legal requirement, or to save a life.

2026 change: the Data (Use and Access) Act 2025 names direct marketing as an example of something that may be a legitimate interest for an organisation. The regulator's guidance, updated in July 2026 for the Act, still says you have the right to object to direct marketing and organisations can't refuse.

If an organisation doesn't respond

If an organisation ignores your request to object, delete or see your data, or you're unhappy with its answer, complain to the organisation first, then to the regulator.

Check its complaints process: its privacy notice, a complaints page, or by asking. Use its form or complaints email if it has one; otherwise write a letter or email. The regulator has a template.
Keep a record, and follow up any phone complaint in writing.

Since 19 June 2026, the organisation has 30 days to acknowledge your complaint, starting the day after it receives it. It must then give you an outcome without unjustifiable or excessive delay; the law doesn't set a fixed deadline for the outcome.

Then the regulator: the Information Commission, which replaced the Information Commissioner's Office (ICO) on 30 September 2026. Its website is still ico.org.uk and still says "ICO".
When: you can complain at any time, but the regulator recommends giving the organisation a chance to finish its own process first. Its SAR guidance says to complain within three months of your last meaningful contact with the organisation.
How: through the online complaint form. Have a copy of your complaint to the organisation ready.
How long: the regulator says complaints that need closer examination are currently assigned to a case officer around 10 months after submission.
What it can't do: it can't award compensation. You can claim compensation from the organisation directly or through the courts, ideally with independent legal advice.

More UK guides

Ask for your data to be deleted: in specific situations, including after you've objected to direct marketing.
Find out what an organisation holds: a subject access request, usually answered within a month.
Check and correct your credit file: free statutory reports from all four agencies, disputes and a 200-word notice of correction.
Stop post for someone who has died: two free registers, MPS and Tell Us Once.
Monitoring at work: what your employer must tell you about monitoring, and your rights to see the records and object.
A neighbour's camera points at your home: what owners must do, and how to ask for a copy of footage or for it to be deleted.
Opt out of NHS data use for research and planning: the national data opt-out, GP records and the Summary Care Record.

Also listed on US people-search sites? See Your data in the US.

The UK data protection regulator became the Information Commission on 30 September 2026. It was previously the Information Commissioner's Office (ICO), and its guidance is still at ico.org.uk.

Sources

This page describes your options and how organisations say they handle requests. It isn't legal advice. See About & sourcing, or report a correction.