Make your website GDPR compliant today — Cookiebot automates cookie consent, scanning, and compliance so you don't have to. Try Cookiebot Free

Data Subject Rights

Comprehensive overview of the rights individuals have over their personal data under GDPR and how to facilitate them.

Data Subject Rights under GDPR

The GDPR provides individuals with enhanced rights over their personal data. Organizations must have processes in place to facilitate these rights effectively.

The Eight Rights

1. Right to be Informed (Articles 13-14)

  • Individuals have the right to be informed about the collection and use of their personal data
  • This is provided through privacy notices

2. Right of Access (Article 15)

  • Individuals can request a copy of their personal data
  • Also known as a Subject Access Request (SAR)
  • Must be provided free of charge within one month

3. Right to Rectification (Article 16)

  • Individuals can have inaccurate personal data corrected
  • They can also complete incomplete data

4. Right to Erasure (Article 17)

  • Also known as 'right to be forgotten'
  • Enables individuals to request deletion of their data in specific circumstances

5. Right to Restrict Processing (Article 18)

  • Individuals can request that processing of their data is limited in certain circumstances
  • Data can be stored but not used

6. Right to Data Portability (Article 20)

  • Individuals can obtain and reuse their data for their own purposes
  • Data must be provided in a machine-readable format

7. Right to Object (Article 21)

  • Individuals can object to processing based on legitimate interests or public interest
  • Absolute right to object to direct marketing

8. Rights Related to Automated Decision-Making (Article 22)

  • Right not to be subject to solely automated decision-making with legal or significant effects
  • Right to human intervention and to contest decisions

Response Timelines

Organizations must respond to requests:

  • Without undue delay
  • Within one month of receipt
  • Can be extended by two further months for complex requests
  • Must inform the individual within one month if extension is needed

Verification and Fees

Organizations can:

  • Request additional information to verify the identity of the requester
  • Charge a reasonable fee for manifestly unfounded or excessive requests
  • Refuse to act on manifestly unfounded or excessive requests

Facilitating Rights

Organizations should:

  • Make it easy for individuals to exercise their rights
  • Provide clear information about how to make requests
  • Have documented procedures for handling requests
  • Train staff on handling data subject requests
  • Keep records of requests and responses

Related Articles