Data subject rights under the GDPR

In short: Anyone affected by data processing has rights: access, rectification, erasure, restriction, data portability and objection.

In more detail: The controller must usually answer requests within one month. Access covers the stored data, purposes, recipients, retention period and source. The right to erasure does not apply if legal retention duties stand against it.

In Depth

• Access (Art. 15): a copy of the data, free of charge.
• Rectification (Art. 16): correct wrong data.
• Erasure (Art. 17): “right to be forgotten” when the purpose has ceased, consent is withdrawn or data was processed unlawfully.
• Restriction (Art. 18): data stays stored but is not used.
• Data portability (Art. 20): receive data in a machine-readable format (GDPR data export).
• Objection (Art. 21): against processing on the basis of legitimate interest and direct marketing.
• Complaint: to the data protection supervisory authority.
• Verify identity: Before giving access it must be ensured that the right person asks.

See also: GDPR: principles and legal bases, Account deletion with objection period