GDPR grants individuals several rights:

• Right of Access - obtain copies of personal data (Article 15)
• Right to Rectification - correct inaccurate data (Article 16)
• Right to Erasure - "right to be forgotten" (Article 17)
• Right to Restriction - limit processing (Article 18)
• Right to Data Portability - receive data in portable format (Article 20)
• Right to Object - object to processing (Article 21)
• Rights Related to Automated Decision-Making (Article 22)

To request your personal data (Subject Access Request):

1. Contact the organization's data protection officer or privacy team
2. Submit your request in writing (email is acceptable)
3. Provide proof of identity if requested
4. The organization must respond within one month

Related: Article 15: Right of Access

Processing must be based on at least one of six legal bases:

1. Consent - clear affirmative action
2. Contract - necessary for contract performance
3. Legal Obligation - required by law
4. Vital Interests - protect someone's life
5. Public Task - official function in public interest
6. Legitimate Interests - pursuing legitimate interests (with balancing test)

Related: Article 6: Lawfulness of Processing

A DPO is mandatory if:

• You are a public authority (except courts acting in judicial capacity)
• Your core activities require regular and systematic monitoring of individuals on a large scale
• Your core activities involve large-scale processing of special categories of data or criminal conviction data

Related: Article 37, Article 38, Article 39

A DPIA is a process to help identify and minimize data protection risks of a project. It's required when processing is likely to result in high risk to individuals' rights and freedoms, particularly when using new technologies or processing special categories of data on a large scale.

Related: Article 35: Data Protection Impact Assessment

Organizations must implement appropriate technical and organizational measures, including:

• Pseudonymization and encryption
• Ensuring confidentiality, integrity, availability, and resilience
• Ability to restore data availability after incidents
• Regular testing and evaluation of security measures

Related: Article 32: Security of Processing

In case of a personal data breach:

• Notify the supervisory authority within 72 hours if the breach poses a risk to individuals' rights (Article 33)
• Notify affected individuals without undue delay if the breach poses a high risk (Article 34)
• Document all breaches, even if not reported

Yes, but only with appropriate safeguards:

• Transfer to countries with adequacy decisions (Article 45)
• Use of Standard Contractual Clauses (SCCs) (Article 46)
• Binding Corporate Rules (BCRs) for intra-group transfers
• Specific derogations for specific situations (Article 49)

Related: Chapter V: Transfers

GDPR violations can result in administrative fines up to:

• €10 million or 2% of annual global turnover (whichever is higher) for certain violations
• €20 million or 4% of annual global turnover (whichever is higher) for more serious violations

Related: Article 83: Administrative Fines