GDPR Subject Rights

The main reason why GDPR law was created, in the first place, was to regulate how private data for EU citizens is controlled and processed, and in that aspect, it did give people, in their capacities as EU citizens, a range of specific data rights with regards to their personal data. The citizens, or data subjects – as we are going to refer to them in this article – can exercise these rights under particular conditions, and the data controllers – the organisations – must enable them to exercise these rights. This is, in fact, one of the requirements of GDPR compliance. Now, while there were some rights that were already introduced under the previous data protection law, there are several other rights that are unique to the GDPR, and in this article, we will take a look at all of them. The data rights include:

The right to be informed – this right allows the data subjects to know the data about them that is collected, why it is being collected, who is collecting the data, the time period the data will be kept, with whom the data is shared with, and lastly, how they can complain whenever issues arise. Now, all this information must be communicated to the data subjects clearly, and beforehand.

Right of access – EU citizens do have a right to submit data access requests when trying to find out how and whether their data is being processed by the organisation. When that happens, the organisation is required to provide the following information:

  • What’s the purpose of the data processing?
  • The categories of data being processed
  • With whom the data is being shared
  • Information regarding their GDPR rights
  • The data retention period
  • The source of the data being processed, especially if the data was not collected from the individual.

Right to rectification – The data subjects also have a right to rectify their personal at any time, when they find inconsistencies or inaccurate data, or even when the data is incomplete, and they want to update the information. There are instances where the organisation might notice and confirm the inaccuracy, and in that case, they will notify the data subjects, who will be required to respond within a month. The individual will allow the organisation to rectify the data. This however may present a number of operational challenges for the organisation, as rectifying may have an impact on the entire database.

The right to be forgotten – also known as the right to erasure, it allows the individuals to ask for specific data to be erased, especially if:

  • The data is no longer necessary
  • The individual withdraws consent
  • The data was processed unlawfully
  • The individual objects to data processing and the controller doesn’t have any reason to continue processing
  • The erasure is necessary for GDPR compliance

However, there are instances when the data controller may decline the request, especially if the public interest is involved, or when being compliant with legal obligations. Now, whenever a data subject exercises their right to erasure, the data controller has the obligation to notify any third parties with whom the data was shared to erase the data as well.

The right to restrict processing – under the GDPR law, individuals can now limit how an organisation processes their personal data. This means that the organisation has to refrain from processing data without the individual’s consent. However, this happens when:

  • The data to be processed is inaccurate
  • The processing doesn’t adhere to any of the lawful basis
  • The controller no longer needs the data, but the data subject wants it to be preserved for future use.
  • Or, when the controller wants to verify a data erasure request.

Once a data subject exercises his/her right to restrict processing, the organisation is not allowed to process, unless with consent from the individual, in compliance with a legal claim, or in protecting the rights of other people.

The right to data portability – data portability allows the individual to obtain their own data that their previously provided to the data controller, in a structured, machine-readable, and commonly used format. Also, in exercising their right to data portability, data subjects can request their personal data to be directly transferred to another organisation. Keep in mind that this only applies to data the individuals provided to the organisation, either by contract or consent. It may also include any data that are related to the individual’s behaviour including location data, search inquiries, or even website history.

The right to object to processing – the individual can also object to the processing of specific data at any point in time, depending on specific aspects of data processing such as lawful basis as well as the purpose for processing. Even on grounds of legitimate interests such as legal purposes or when the processing is in the interest of the public, the data subject will be within his/her rights to object to the processing.

The right to reject/accept the automated decision making and profiling – as we have already mentioned, the GDPR did introduce several strict rules in terms of processing personal data, especially without involving the data subjects. This, of course, did include various types of profiling, including evaluating specific personal aspects that analyse and predicts individual behaviour such as performance at work, health, interests, personal preferences, location, reliability, or behaviour. On this aspect though, the data subjects now have a right to reject automated individual decision making, especially if it has a legal effect that directly affects them significantly.

Are the rights of data subjects under GDPR absolute?

Well, no, they are not! This is a pretty common misconception and it’s not true. Now, under no circumstances will these rights ever be lost, and we have to admit that they have transformed how organisations are handling EU citizens’ personal data. And while these rights are assured under the GDPR law, there are certain conditions where these rights won’t be granted. For instance, the right to restrict the processing of personal data can’t be exercised in instances where the purpose is to prevent an investigation, prosecution, and detention of criminal offences. Also, if data is being processed with the aim of preventing threats to public security, the data subjects won’t be able to exercise their right to restrict the processing. In another instance, the right to access personal data is, of course, exercised by a lot of individuals, and this is well within the GDPR regulations, however, if that access adversely affects the rights and freedom of other people, of course, it won’t be allowed.

So, as you can see, the rights of data subjects are not absolute. There are times when the rights will be allowed, and there are times they will be denied. There are also times when there might be charges applied before the data subjects’ rights are granted. Organisations must be aware of this and react accordingly.

What happens when organisations violate data subject rights?

If an organisation, data controller, violates the rights of individuals, it attracts some of the toughest penalties. You see, under the GDPR regulation, an organisation can be fined up to 20 million euros, or up to 4% of their total global turnover – whichever is higher. And that’s not all, you haven’t put into consideration the reputational damage the organisation will suffer as a result. So, this is a real risk, and organisations must be very careful when it comes to GDPR compliance.

Final thought

Yes, the GDPR logistics might largely apply to organisations, as they are largely the data controllers and processors, but the truth is, the spirit of the regulations was all about protecting the data subjects. This is the reason why there were clear rights stated under the law, and some heavy penalties were introduced. Now, each of the data subject’s rights does reflect the principles of transparency and accountability woven through the entire legislation, from accessing the data, to updating it, and lastly, restricting or objecting to processing it in some cases. The eight data subject rights must be upheld by the data controllers and processors, failure to which will lead to GDPR violation, which will, in turn, attract significant fines.   

45 thoughts on “GDPR Subject Rights”

  1. Pingback: GDPR Encryption Requirements – GDPR Advisor

  2. Pingback: GDPR Data Mapping - GDPR Advisor

  3. Pingback: Data Controllers and Processors under GDPR: Understanding Your Roles and Responsibilities - GDPR Advisor

  4. Pingback: Securely Navigating the Cloud: GDPR Compliance for Cloud Data Storage - GDPR Advisor

  5. Pingback: Navigating DPIA: Understanding When and How to Conduct a Data Protection Impact Assessment - GDPR Advisor

  6. Pingback: Protecting Personal Data in the World Cup: A Look at GDPR and FIFA - GDPR Advisor

  7. Pingback: Navigating GDPR Compliance in Digital Marketing - GDPR Advisor

  8. Pingback: GDPR and Data Integrity: Safeguarding Personal Information in the Digital Age - GDPR Advisor

  9. Pingback: Your Data, Your Rights: Understanding Personal Data under UK Law - GDPR Advisor

  10. Pingback: GDPR Training: Ensuring Compliance Across Your Organisation - GDPR Advisor

  11. Pingback: Navigating GDPR Lawful Bases: A Guide for Data Processing - GDPR Advisor

  12. Pingback: Data Mapping and GDPR: Key Considerations for Third-Party Data Sharing and Processing - GDPR Advisor

  13. Pingback: How Does the General Data Protection Regulation (GDPR) Apply in the UK? - GDPR Advisor

  14. Pingback: GDPR for Sports Clubs - GDPR Advisor

  15. Pingback: Protecting Personal Data with Pseudonymization under GDPR - GDPR Advisor

  16. Pingback: Cold Calling and Outbound Marketing Companies: Navigating GDPR Compliance - GDPR Advisor

  17. Pingback: Data Subject Rights and Data Controllers: Responding to Requests and Ensuring Compliance - GDPR Advisor

  18. Pingback: Crafting a GDPR-Compliant Privacy Policy: A Guide for Businesses - GDPR Advisor

  19. Pingback: Empowering Data Subjects: Understanding Your Rights under GDPR - GDPR Advisor

  20. Pingback: Understanding the Basics of Data Mapping and Its Importance for GDPR Compliance - GDPR Advisor

  21. Pingback: GDPR Compliance in the Cloud: Ensuring Data Security and Privacy - GDPR Advisor

  22. Pingback: GDPR Compliance for Small and Medium-Sized Enterprises (SMEs): Practical Tips - GDPR Advisor

  23. Pingback: A Guide to GDPR for Small Businesses - GDPR Advisor

  24. Pingback: GDPR and Artificial Intelligence: Challenges and Ethical Considerations - GDPR Advisor

  25. Pingback: GDPR Compliance for Third-Party Service Providers: Vendor Management and Data Protection - GDPR Advisor

  26. Pingback: GDPR Compliance for Mobile Applications: Protecting User Data on Smart Devices - GDPR Advisor

  27. Pingback: GDPR Compliance for SaaS Companies: Addressing Data Privacy Challenges - GDPR Advisor

  28. Pingback: The Importance of GDPR Compliance: Protecting User Privacy in the Digital Age         - GDPR Advisor

  29. Pingback: GDPR Compliance for Nonprofit Organisations: Balancing Transparency and Donor Privacy - GDPR Advisor

  30. Pingback: GDPR Compliance for Educational Institutions: Safeguarding Student Data - GDPR Advisor

  31. Pingback: GDPR Compliance for Startups: Building a Privacy-Focused Foundation - GDPR Advisor

  32. Pingback: GDPR Compliance for Financial Institutions: Protecting Customer Data in the Banking Sector - GDPR Advisor

  33. Pingback: Understanding GDPR: How it Impacts Businesses Worldwide - GDPR Advisor

  34. Pingback: GDPR Compliance Checklist: Essential Steps for Organisations - GDPR Advisor

  35. Pingback: GDPR Compliance for Software Development: Integrating Privacy into the SDLC - GDPR Advisor

  36. Pingback: GDPR and Biometric Data: Privacy Implications and Regulatory Compliance - GDPR Advisor

  37. Pingback: GDPR and Cross-Functional Compliance: Collaboration between Legal, IT, and Security Teams - GDPR Advisor

  38. Pingback: GDPR and Video Surveillance: Privacy Considerations for CCTV Systems - GDPR Advisor

  39. Pingback: GDPR Compliance and Data Transfer Agreements: Navigating Legal Requirements - GDPR Advisor

  40. Pingback: GDPR Compliance for IT Service Providers: Ensuring Security and Data Protection - GDPR Advisor

  41. Pingback: GDPR Compliance for Event Organisers: Safeguarding Attendee Data - GDPR Advisor

  42. Pingback: GDPR Compliance for Freelancers and Independent Contractors: Protecting Client Data - GDPR Advisor

  43. Pingback: GDPR Compliance for Non-EU Businesses: Implications and Requirements - GDPR Advisor

  44. Pingback: GDPR Compliance for E-commerce Marketplaces: Safeguarding Consumer Data in Online Platforms - GDPR Advisor

  45. Pingback: GDPR Compliance for Government Agencies: Balancing Transparency and Data Protection - GDPR Advisor

Leave a Comment

Your email address will not be published. Required fields are marked *