Data subject rights

The law gives people eight rights over their data and obliges organizations to make them easy to exercise. Breaching these rights falls into the most serious category of penalties (Article 94(2)).

The eight rights

• The right to information: who processes the data, for what purpose and on what basis (Article 13).
• The right of access: confirmation of whether data is processed, and a copy of it (Article 14).
• The right to rectification of inaccurate or incomplete data (Article 15).
• The right to erasure, for example when the data is no longer needed or consent is withdrawn and there is no other legal basis (Article 15).
• The right to be forgotten, where the data has been made public (Article 16).
• The right to restriction of processing (Article 17).
• The right to data portability to another controller (Article 18).
• The right to object to processing, and not to be subject to solely automated decisions with serious effects (Articles 19 and 20).

The deadline to respond (Article 12)

• The controller replies as soon as possible and in any case no later than 30 days from receiving the request.
• The deadline may be extended to up to 60 days where the complexity or number of requests requires it. The data subject is told about the extension, with reasons, within 30 days.
• Where a request is refused, the data subject is told within 30 days of the reasons and of the right to complain to the Commissioner and to go to court.

Cost and identity

• The reply is free of charge. Only for manifestly unfounded or excessive requests may a reasonable fee be charged or the request refused, and the burden of proof lies with the controller.
• Where there are reasonable doubts about the requester's identity, the controller asks for additional information to verify it.

Direct marketing

Where data is used for direct marketing, the person can object at any time and without giving reasons, and the controller must stop processing for that purpose (Article 19(2) and (3)). Marketing can rely on legitimate interest, but explicit consent is required for sensitive data (Article 46).