What rights do individuals have under GDPR?
Last updated
Last updated
GDPR set out the rights of data subjects. The main rights are summarized below but we recommend you refer to the regulations for a full list of rights.
Individuals have the right to be informed about the collection and use of their personal data. This is a key transparency requirement under GDPR.
You must provide individuals with information including: your purposes for processing their personal data, your retention periods for that personal data, and who it will be shared with. We call this ‘privacy information’.
You must provide privacy information to individuals at the time you collect their personal data from them.
The information you provide to people must be concise, transparent, intelligible, easily accessible, and it must use clear and plain language.
Individuals have the right to access and receive a copy of their personal data, and other supplementary information. This is commonly referred to as a subject access request or ‘SAR’.
In most circumstances, you cannot charge a fee to deal with a request.
You should respond without delay and within one month of receipt of the request.
You should provide the information in an accessible, concise and intelligible format.
The information should be disclosed securely.
You can only refuse to provide the information if an exemption or restriction applies, or if the request is manifestly unfounded or excessive.
The GDPR includes a right for individuals to have inaccurate personal data rectified, or completed if it is incomplete.
An individual can make a request for rectification verbally or in writing.
You have one calendar month to respond to a request.
The GDPR introduces a right for individuals to have personal data erased.
The right to erasure is also known as ‘the right to be forgotten’.
The right is not absolute and only applies in certain circumstances.
Individuals can make a request for erasure verbally or in writing.
Individuals have the right to request the restriction or suppression of their personal data.
This is not an absolute right and only applies in certain circumstances.
When processing is restricted, you are permitted to store the personal data, but not use it.
The right to data portability allows individuals to obtain and reuse their personal data for their own purposes across different services.
It allows them to move, copy or transfer personal data easily from one IT environment to another in a safe and secure way, without affecting its usability.
Doing this enables individuals to take advantage of applications and services that can use this data to find them a better deal or help them understand their spending habits.
The right only applies to information an individual has provided to a controller.
The UK GDPR gives individuals the right to object to the processing of their personal data in certain circumstances.
Individuals have an absolute right to stop their data being used for direct marketing.
In other cases where the right to object applies you may be able to continue processing if you can show that you have a compelling reason for doing so.
You must tell individuals about their right to object.
The GDPR has provisions on:
automated individual decision-making (making a decision solely by automated means without any human involvement); and
profiling (automated processing of personal data to evaluate certain things about an individual). Profiling can be part of an automated decision-making process.