Rights of Data Subjects under GDPR

pg. 129

request a copy of personal data

Complete a subject access request (SAR).
They must recieve data within 30 days of request

Right to information

Know what data is collected, why, who collects it, how long it is kept, if it is shared and how to file a complaint

Recification of data

Request correction of inaccurate/incomplete data.
Organisation must respond within 30 days if inaccurate.

Right to be forgotten

Request deletion of their personal data in certain circumstances, e.g. if data is no longer needed for the purposes it was collected for.

Request data portability

Obtain data in a structured, commonly used, machine-readable format
Can ask data to be transferred to another organisation

Rights re. automated decision making + profiling

Data subjects have the right not to be subject to automated decisions that produce legal/significant events. They can request human intervention and can contest the decision
E.g. bank using algorithm to automatically approve/deny loan application

Right to object

can object to processing of personal data at any time

Right to restrict processing

limit how an organisation uses personal data especially when the accuracy of data is disputed

consent

give/withdraw consent for the processing of personal data