Data Subject Rights and Consent Management
This domain tests the operational side of privacy: recognising each right, running a request within the statutory clock, verifying identity without over-collecting, and applying exceptions correctly. Consent items test validity, granularity, withdrawal and children's data.
Core rules
- GDPR rights: information (13–14), access (15), rectification (16), erasure (17), restriction (18), portability (20), objection (21), and rights on automated decision-making (22). Respond within one month, extendable by two further months for complex requests; generally free, with narrow exceptions for manifestly unfounded or excessive requests.
- Erasure exceptions include legal obligations, establishment or defence of legal claims, freedom of expression, and public health or archiving.
- Portability applies only to data provided by the data subject, processed by automated means on a consent or contract basis; it is not the same as access.
- Consent (GDPR Articles 4(11), 7): freely given, specific, informed, unambiguous indication by a clear affirmative action; separate from other terms; as easy to withdraw as to give. Children: 16 default, reducible to 13 by Member State, with parental consent for information society services.
- CCPA/CPRA rights: know/access, delete, correct, opt out of sale or sharing, limit use of sensitive personal information, non-discrimination. Respond within 45 days, extendable by 45; requests cover the prior 12 months.
- Verification must be proportionate; do not collect more identity data than necessary.
Worked example
A customer with an active broadband contract requests erasure of all data. The request is partly valid. Marketing data, call recordings and analytics can be erased. Billing and contract records must be retained under tax and contract law, and data needed to defend a pending dispute is exempt. The correct response is partial erasure plus a reasoned explanation of what is retained and why - not blanket refusal and not blanket deletion.
Traps that cost marks
- Confusing access with portability, or dumping everything when the request is narrower.
- Deleting records subject to legal holds or statutory retention.
- Treating silence, pre-ticked boxes or "by continuing to browse" as valid consent.
- Missing agent requests under CCPA or the 45-day clock.
- Using a DSAR as an excuse to demand excessive identity documents.