GDPR Data Subject Rights: Secure Your Privacy

Understanding GDPR

Before exploring the GDPR data subject rights, it’s crucial to have a firm grasp of the General Data Protection Regulation (GDPR) itself. This legislation, effective in May 2018, is the European Union’s (EU) primary legal framework for protecting the personal data of individuals in the EU and EEA (European Economic Area).

The Basics of GDPR

The General Data Protection Regulation (GDPR) is a regulatory framework instituted by the European Union (EU) to protect the privacy and personal data of its citizens. Enforced since May 2018, GDPR applies to all businesses and organizations that process the personal data of EU citizens, regardless of their geographical location.

GDPR outlines several key principles that form the foundation of data protection: lawfulness, fairness, transparency, data minimization, accuracy, storage limitation, integrity, and confidentiality.

At its core, the regulation aims to achieve two primary goals:

Individual Control: To give individuals greater control over their personal data and how it is used.
Regulatory Simplification: To simplify the regulatory environment for international businesses operating within the EU by providing a single, unified set of data protection rules.

For a detailed overview of the GDPR and its requirements, visit our article on general data protection regulation.

The Importance of Data Privacy

In today’s digital age, data privacy has become increasingly important. Personal data, as defined by GDPR (General Data Protection Regulation), includes any information that can be used to identify an individual directly or indirectly. This can range from common identifiers like names and email addresses to more sensitive information like medical records or financial data.

Data privacy is crucial for several reasons:

Protecting Individuals: It safeguards individuals from potential harm, such as identity theft, financial loss, or damage to personal reputation.
Building Trust: Respecting privacy rights helps to build trust between individuals and the businesses or organizations that handle their personal data.
Legal Obligation: With the implementation of GDPR, data privacy is no longer just a best practice; it’s a legal requirement. Failure to comply with GDPR can result in hefty fines (up to 4% of global turnover) and significant damage to an organization’s reputation.

Understanding the importance of data privacy is the essential first step towards achieving robust GDPR compliance. To delve deeper into the specific requirements of GDPR, check out our gdpr requirements article.

In the following sections, we will explore the specific rights that GDPR grants to individuals, known as GDPR data subject rights. These rights form the cornerstone of GDPR and are essential for any organisation to fully comply with the regulation.

GDPR Data Subject Rights

In the realm of data privacy, understanding GDPR Data Subject Rights is paramount. These rights form the cornerstone of the General Data Protection Regulation (GDPR), ensuring individuals have control over their personal data.

What Are Data Subject Rights?

Data Subject Rights (DSRs) under GDPR refer to the fundamental rights of individuals regarding their personal data. These rights empower individuals to have a say in how companies use their data, setting the gold standard for data privacy regulations across the globe.

These rights collectively give individuals a significant degree of control over their personal data, a fundamental principle of the General Data Protection Regulation (GDPR):

Right to Access (DSAR): Individuals have the right to obtain confirmation as to whether or not personal data concerning them is being processed, and to obtain a copy of that data, along with supplementary information.
Right to Rectification: Individuals have the right to have inaccurate personal data corrected without undue delay. If data is incomplete, they have the right to have it completed.
Right to Erasure (‘Right to be Forgotten’): Individuals can request the deletion or removal of personal data where there is no compelling reason for its continued processing (e.g., when the data is no longer necessary for the purpose it was collected). This right is not absolute and does not apply if the data is needed for legal or public interest reasons.
Right to Restrict Processing: Individuals have the right to block or limit the processing of their personal data under certain circumstances (e.g., while the accuracy of the data is being verified).
Right to Data Portability: Individuals have the right to obtain and reuse their personal data for their own purposes across different services. This requires the data to be provided in a structured, commonly used, and machine-readable format.
Right to Object: Individuals have the right to object to the processing of their personal data in certain defined situations, particularly processing carried out for direct marketing purposes.

The Main Principles of GDPR Data Subject Rights

The main principles of GDPR Data Subject Rights (DSRs) revolve around transparency, control, and accountability, forming the foundational framework for how organizations must handle personal data.

Transparency: Data subjects have the fundamental right to be informed about how their data is being processed, who is processing it, and for what purposes, ensuring all data processing activities are open, honest, and easily understandable. This requires that privacy policies and consent requests be written in clear, concise language that is fully accessible to the average person, thereby guaranteeing that the individual knows precisely what is happening to their personal data.
Control: Data subjects have the right to actively control how their data is used and the ability to challenge its use, which reinforces individual autonomy. This core principle manifests through several specific rights, including the right to access their data (DSAR), rectify inaccuracies, request the deletion of their data (Right to Erasure), restrict its processing, and object to its use for certain purposes like direct marketing.
Accountability: Companies that process personal data are accountable for complying with all Data Subject Rights (DSRs) and must be able to demonstrate that compliance to regulatory authorities. This necessitates that organizations maintain meticulous records of all data processing activities (ROPA) and establish robust, prompt procedures for handling and responding to all data subject requests within the strict mandatory legal timeframes.

These principles serve as the foundation for GDPR Data Subject Rights, reinforcing the importance of data privacy and protection. Understanding these rights and how to apply them is a key aspect of GDPR compliance. For a more comprehensive understanding of GDPR requirements, check our GDPR requirements post.

In the next section, we’ll delve deeper into each of these data subject rights, exploring how they empower individuals and reshape the way companies handle personal data.

Detailed Exploration of GDPR Data Subject Rights

The General Data Protection Regulation (GDPR) affords individuals several fundamental rights concerning their personal data. These GDPR data subject rights (DSRs) empower individuals to take control of their personal information and collectively provide a framework for businesses to handle such data responsibly.

Right to Access

Under GDPR, the right of access (commonly referred to as a Data Subject Access Request, or DSAR) gives individuals the right to obtain a copy of their personal data being processed by an organisation. This transparency is a cornerstone of GDPR and helps individuals understand how their data is being handled. For more insight into GDPR principles, see our article on general data protection regulation.

Right to Rectification

If an individual finds that the personal data held by an organisation is incorrect or incomplete, they have the right to have it rectified. Businesses must comply with such requests within a reasonable timeframe, ensuring the accuracy of the data they process.

Right to Erasure

Also known as the “right to be forgotten,” this allows individuals to request the deletion of their personal data. This right is not absolute and applies only in certain circumstances, such as when the data is no longer necessary for the purpose it was originally collected. For a detailed understanding of the conditions, refer to our guide on gdpr requirements.

Right to Restrict Processing

In some instances, individuals have the Right to Restrict Processing of their personal data.

This right applies when certain conditions are met, such as when:

The individual contests the accuracy of the data, and the business needs time to verify the accuracy.
The individual objects to the processing based on legitimate interests or public interest grounds.
The processing is unlawful, and the data subject opposes erasure and requests restriction instead.
The business no longer needs the data for the original processing purpose, but the individual requires the data for the establishment, exercise, or defense of legal claims.

During the period of restriction, businesses can still store the data but are limited in how they can use it. This essentially places the data “on hold” until the dispute or issue is resolved.

Right to Data Portability

The Right to Data Portability (Article 20 of the GDPR) gives individuals the right to receive their personal data that they have provided to a controller in a specific, usable format.

They can also request that this data be transferred directly to another organization (controller), where it is technically feasible for the current organization to do so.

Key Requirements and Scope

Applicable Data: This right applies only to digital data that the individual has “provided to” the organization. This includes data they actively entered (like their name or email) and data generated by their use of the service (like search history or location data).
Exclusions: It generally excludes derived data generated by the organization itself through analysis (e.g., a calculated credit score or profile).
Legal Basis: The right only applies if the processing is based on consent or for the performance of a contract.
Required Format: The data must be provided in a structured, commonly used, and machine-readable format (e.g., a CSV file) to ensure it can be easily reused and integrated into another service.

While organizations must comply with a request for direct transfer to a new provider, they are not obligated to adopt or maintain processing systems that are technically compatible with those of other organizations. The assessment of technical feasibility is made on a case-by-case basis, but organizations should not put in place legal, technical, or financial obstacles to hinder the transmission.

For a deeper understanding of what constitutes personal data under GDPR, note that the term is interpreted broadly as any information relating to an identified or identifiable natural person. This includes identifiers like a name, email address, IP address, or cookie ID. Refer to our article on gdpr personal data definition.

Right to Object

Individuals have the Right to Object to the processing of their personal data in certain circumstances. This right allows them to challenge how their data is used, requiring the organization to stop processing unless it can demonstrate a compelling, overriding legitimate ground.

This right is generally applicable to processing for three key purposes:

Legitimate Interests: Processing necessary for the organization’s legitimate interests (unless the organization can demonstrate compelling, legitimate grounds that override the individual’s interests).

Direct Marketing: This is an absolute right; organizations must stop processing data for direct marketing immediately upon objection.

Public Interest: Processing necessary for the performance of a task carried out in the public interest.

Understanding and implementing these GDPR data subject rights is crucial for any organization that processes personal data. Honoring these rights not only ensures compliance with GDPR (avoiding legal penalties) but also actively promotes trust and transparency with the individuals whose data is being processed, which is a key competitive advantage in the digital age. For practical steps on implementing these rights, see our gdpr compliance checklist.

Implications of GDPR Data Subject Rights

The General Data Protection Regulation (GDPR) and, in particular, GDPR data subject rights have significant implications for both businesses and individuals. Let’s explore these impacts further.

Impact on Businesses and Organisations

The GDPR data subject rights (DSRs) have fundamentally reshaped the way businesses and organizations handle personal data, leading to a much greater emphasis on transparency, accountability, and security in all data processing activities.

Under GDPR, businesses must ensure that they inform individuals about their data subject rights in a clear and accessible manner. This shifts the burden onto the organization, often requiring the creation of detailed privacy policies and informative notices about data collection and processing that are written in simple, understandable language.
Organizations must implement robust systems and processes to handle requests from individuals exercising their DSRs. This requires efficient internal workflow management to process requests for: access to data (DSAR), rectification of inaccuracies, erasure of data (Right to be Forgotten), objections to processing
The GDPR mandates stringent security measures to protect personal data, including encryption, pseudonymisation, and regular security assessments. In the event of a data breach, organizations are required to notify the relevant supervisory authorities (within 72 hours) and, in high-risk cases, the individuals affected.

Non-compliance with GDPR can result in hefty fines and reputational damage. Therefore, businesses should consult a GDPR compliance checklist and consider investing in GDPR data protection training for their staff.

Impact on Individuals

For individuals, the GDPR data subject rights (DSRs) provide greater control over their personal data. These fundamental rights empower individuals to fully understand how their data is being used, who it is shared with, and how it is protected.

The DSRs establish a comprehensive framework for individual data ownership and influence:

Right to Access (DSAR): Allows individuals to request a copy of their personal data held by a business, along with supplementary information about the processing.
Right to Rectification: Enables the correction of inaccurate or incomplete data held by the organization, ensuring data quality is maintained.
Right to Erasure (‘Right to be Forgotten’): Allows individuals to request the deletion of their data in specific circumstances (e.g., when the data is no longer necessary for the original purpose).
Right to Object: Individuals can object to the processing of their data for certain purposes, particularly giving them the absolute right to stop their data from being used for direct marketing purposes.
Right to Data Portability: Allows individuals to obtain their data in a structured, commonly used format and to transfer it from one service provider to another without hindrance.

In essence, GDPR data subject rights empower individuals to take ownership of their personal data and to hold businesses accountable for their data processing activities. This marks a significant shift in the power dynamics between individuals and organizations when it comes to data privacy and protection. By understanding the implications of DSRs, businesses can better align their data processing activities with the regulation, and individuals can more effectively exercise their rights and protect their personal data.

Practical Ways to Exercise GDPR Data Subject Rights

Within the framework of the General Data Protection Regulation (GDPR), individuals (data subjects) are given a set of rights that empower them to have control over their own personal data. Exercising these rights requires the individual to initiate a request, and requires the Data Controller to respond within strict legal timeframes.

Steps to Request Access to Personal Data

The first and foundational step in recognizing revenue under IFRS 15 is to identify the contract(s) with a customer. A contract is defined as an agreement between two or more parties that creates enforceable rights and obligations. A contract can be written, oral, or implied by an entity’s customary business practices.

Approval: The parties have approved the contract and are committed to performing their obligations.
Identifiable Rights: Each party’s rights regarding the goods or services to be transferred can be clearly identified.
Identifiable Payment Terms: The payment terms and conditions for the goods or services can be clearly identified.
Commercial Substance: The contract must have commercial substance, meaning the risk, timing, or amount of the entity’s future cash flows is expected to change as a result of the contract.
Probable Collectability: It must be probable that the entity will collect the consideration to which it expects to be entitled in exchange for the goods or services.

Remember to keep a copy of your request, and note the date it was sent. This can be useful for follow-ups or if you need to escalate your request.

How to Invoke the Right to Erasure

Also known as the “right to be forgotten”, the right to erasure allows individuals to request the deletion or removal of personal data where there is no compelling reason for its continued processing. This right is not absolute and only applies in specific circumstances, such as when the data is no longer necessary for the purpose it was originally collected, or the individual withdraws consent.

Identify the Organization: Pinpoint the correct organization (Data Controller) that is currently holding your personal data.
Write a Formal Request: Write a formal request, typically via email, making it explicitly clear that you are invoking your Right to Erasure under GDPR.
State Your Reason: You must clearly state your reason for requesting the erasure. This is vital because the right is not absolute; you must cite one of the specific circumstances outlined in the GDPR (e.g., “The data is no longer necessary for the purpose it was collected”).
Document and Send: Send your request and wait for the organization’s response, diligently keeping a detailed record of your communication and the date it was sent for follow-up or potential escalation.

Managing Consent and Objections

The General Data Protection Regulation (GDPR) empowers individuals (data subjects) with the right to object to the processing of their data in certain circumstances and the right to withdraw their consent at any time when processing is based on consent.

To Withdraw Consent: Individuals should reach out to the organization, ideally in writing, stating clearly that they are withdrawing their consent for the organization to process their personal data. The organization must ensure it is as easy to withdraw consent as it was to give it, and processing must cease immediately.
To Object to Processing: Individuals should send a formal communication to the Data Controller, explicitly stating their objections and the reasons for them (this is particularly relevant when processing is based on “legitimate interests”).

Once an objection or withdrawal is received, the organization must act promptly:

Cease Processing: The organization should cease the contested processing immediately.
Provide Justification: Processing can only continue if the organization can demonstrate compelling legitimate grounds for the processing that override the interests, rights, and freedoms of the data subject (which is a high legal hurdle).

Exercising your GDPR data subject rights can be an empowering step towards taking control of your personal data. For more information on GDPR and its implications, visit our articles on general data protection regulation and gdpr requirements.

Navigating Challenges in Implementing GDPR Data Subject Rights

The implementation of GDPR data subject rights can present numerous challenges to businesses and organisations. Understanding these challenges and identifying potential solutions can help ensure successful compliance and protection of personal data.

Common Challenges and How to Overcome Them

Understanding GDPR requirements: Misinterpretation or lack of understanding of the GDPR requirements can result in non-compliance. Companies should invest in comprehensive GDPR data protection training for all employees handling personal data to ensure they understand these regulations.
Identifying personal data: The broad GDPR personal data definition can make it difficult for businesses to identify what constitutes personal data. Regular data audits and the appointment of a dedicated GDPR data protection officer can aid in the proper categorisation and handling of personal data.
Fulfilling data subject requests: Timely and accurate fulfillment of data subject requests is crucial in GDPR compliance. Companies can overcome this challenge by implementing efficient data management systems and processes.
Data breaches and notifications: Notifying authorities and data subjects in case of a data breach within the stipulated time can be a daunting task. Having a robust GDPR data breach notification protocol in place can help overcome this challenge.

Importance of Compliance Monitoring and Regular Reviews

Regular compliance monitoring and reviews are essential aspects of GDPR implementation, ensuring that businesses remain up-to-date with evolving regulations and adapt their practices accordingly.

Compliance monitoring involves regular checks (through audits, self-assessments, and third-party reviews) to ensure every aspect of the organization from the GDPR privacy policy to the actions of the GDPR data controller is strictly in line with GDPR regulations. This continuous process requires:

Policy Assessment: Regularly reviewing and updating internal policies and practices (e.g., data retention periods).
Training Updates: Reassessing and updating employee training programs to address changes in regulation and technology.
Response Efficiency: Checking the organization’s procedures for responding to data subject requests to ensure continuous and prompt alignment.

Businesses should always use a GDPR compliance checklist to systematically review and ensure that all necessary requirements are met, thereby reducing the risk of non-compliance and potential penalties.

The journey to GDPR compliance is ongoing, but with the right knowledge and resources, businesses can successfully navigate the challenges and uphold the data subject rights as stipulated in the General Data Protection Regulation. This commitment to continuous learning and adaptation ensures an organization’s data protection strategy remains resilient and trustworthy.

Philip Meagher

12 min read