Compliance and Individual Rights
Rights belong to the individual; duties to the organisation
This domain tests the rights a person can exercise and the organisation's obligations to support them. Questions often ask which right applies or what the organisation must do and by when.
Core rights. Access (a copy of their data and information about processing); rectification (correct inaccurate or incomplete data); erasure ("right to be forgotten", subject to exceptions); restriction (limit processing while a dispute is resolved); objection (including to direct marketing, which is generally an absolute stop); portability (receive data in a structured, commonly used, machine-readable format, where processing is based on consent or contract and is automated); and rights around automated decision-making.
Traps. Candidates confuse access with portability: access is a copy for the individual; portability is a transferable, machine-readable export and applies only in limited circumstances. Erasure is not absolute - legal retention obligations, legal claims, or freedom of expression can override it. Objection to direct marketing is absolute; objection to other processing can be refused if compelling legitimate grounds exist.
Responding to requests. Verify identity, act without undue delay, and respond within the statutory period (commonly one month, extendable for complex cases). Requests are generally free of charge. Refusals must be reasoned and the individual told of their right to complain to a supervisory authority or seek a judicial remedy.
Accountability in practice. Maintain records of processing, train staff, run DPIAs for high-risk work, appoint a data protection officer where required, and have a complaints route. Trap: accountability means being able to show compliance, not merely intend it.
Rule of thumb: identify the right, check for an exception, then apply the clock - verify, respond within the deadline, and explain any refusal with the route to complain.
Worked example: A customer asks for a machine-readable export to move to another provider, and processing is based on consent and automated. That is portability, not access. Provide a structured, commonly used, machine-readable file within the deadline, free of charge.