Data subject rights are the entitlements everyone has in relation to the processing of their personal data: to know what is processed, to have it corrected or erased, to have processing restricted, to take the data with them and to object.
Legal basis
Articles 15 to 22 GDPR contain the rights. Article 15 confers the right of access, with a right to a copy and to information about purposes, categories, recipients and retention. Article 16 covers rectification, Article 17 erasure, Article 18 restriction, Article 20 portability and Article 21 objection, which is absolute for direct marketing. Article 22 protects against decisions based solely on automated processing producing legal effects. Article 12 sets the deadline: respond within one month, extendable by two months where matters are complex. The Court of Justice has held that the right of access applies even where it is exercised for a purpose other than privacy protection, for instance in an employment dispute.
How it works in practice
An access request calls for a structured approach: identifying the requester, searching systems and email, and assessing third-party data appearing in the same documents. Those third parties have rights too, so material is often supplied redacted. Erasure is not an absolute right: statutory retention duties and the establishment or exercise of legal claims can stand in the way.
Where it goes wrong
Organisations respond late, or only from the systems they are aware of, when mailboxes and shared drives are also in scope. A second error is refusing access because the request looks tactical; that is not a ground. Third, identity is verified either too loosely or too intrusively, and a copy of an identity document is rarely necessary.
Related terms
The rights connect to the data processing agreement, the data protection officer and the personal data breach.
Received an access request? Our IT law specialists guide the response within the deadline.
