Data Subject Rights

The GDPR gives people rights over their personal data. When someone uses one, you must answer without undue delay and at the latest within one month, free of charge in most cases (Article 12).

The rights

• Access (Article 15): a copy of their data, plus the purposes, recipients, retention period, source and their other rights.
• Rectification (Article 16): correct inaccurate data and complete incomplete data.
• Erasure (Article 17): delete data when it is no longer needed, consent is withdrawn, processing was unlawful, or they object and you have no overriding reason. Some data must be kept, for example invoices for tax law.
• Restriction (Article 18): keep the data but stop using it, for example while a dispute about its accuracy is resolved.
• Portability (Article 20): data they gave you, processed by automated means on the basis of consent or contract, in a structured, commonly used, machine-readable format.
• Objection (Article 21): stop processing based on legitimate interests unless you show compelling grounds, and always stop direct marketing on request.
• Automated decisions (Article 22): not to be subject to decisions based solely on automated processing that significantly affect them, with exceptions and safeguards.

Deadlines and fees

1. Answer within one month of receiving the request.
2. For complex or numerous requests you may extend by two further months, but you must tell the person within the first month and explain why.
3. No fee, unless a request is manifestly unfounded or excessive. Then you may charge a reasonable fee or refuse, and you must be able to justify it.
4. If you refuse, explain why and tell them they can complain to a data protection authority.

Handling requests well

• Accept requests through any channel, not only a form, and do not demand a specific wording.
• Verify identity in proportion to the risk, without asking for more data than you need.
• Search every system: shop, CRM, email tool, support desk, analytics, backups and processors.
• Pass erasure and rectification on to the recipients you shared the data with (Article 19).
• Log each request, the date, what you did and when you answered. This is your evidence (see Reports).

This guide is general information about EU rules, not legal advice. Requirements can differ by country and by business: check with your data protection authority or a lawyer for your case.