Individual rights of personal information subjects and handling of requests
Individual rights and request handling
This domain tests the rights of personal information subjects and the operational steps a processor must take when a request arrives. Exam items often ask which right applies, what a refusal must contain, and when deletion is mandatory.
Core rights
Articles 44 to 50 give individuals:
- the right to know and decide on processing, and to restrict or refuse processing;
- access and copy rights;
- portability: transfer to another processor designated by the individual where conditions set by the regulator are met;
- correction and supplementation;
- deletion;
- an explanation of automated decision-making, and the right to refuse decisions made solely by automated means that have a significant impact;
- the right to complain and report.
Deletion is required when the processing purpose is achieved or the service stopped, consent is withdrawn, the processor unlawfully processed the data, or other circumstances arise. Where deletion is technically difficult, processing must stop and storage must be secured.
Handling requests
The processor must establish a convenient mechanism and respond within a reasonable time. Identity verification must be necessary and proportionate; demanding excessive documents is a violation. A refusal must state a reason. Where a deceased person's relative exercises access, correction or deletion for their own lawful rights, the processor should handle it unless the deceased arranged otherwise.
Worked example
An employee asks an employer for a copy of attendance and health-check data and for deletion of old health records. The employer must provide a copy of the employee's personal information. For the health records, deletion may be refused while a statutory retention period applies, but the employer must explain the legal basis and stop other use. If the employee asks to transfer payroll data to a new employer, portability depends on regulatory conditions and cannot be refused arbitrarily.
Traps
Deletion is not the same as anonymization. A processor cannot charge an unreasonable fee or require a notarized letter for every request. The right to an explanation does not mean handing over the algorithm. Rights are limited by statutory retention and legal claims, but a blanket refusal is a mark-loser.