Data Subject Rights
The rights
Individuals have a set of enforceable rights over their data:
- Right to be informed - via privacy notices.
- Right of access - a copy of their data (subject access request).
- Right to rectification - correct inaccurate data.
- Right to erasure ("right to be forgotten") - in defined circumstances.
- Right to restrict processing - pause use while a dispute is resolved.
- Right to data portability - receive data in a machine-readable format.
- Right to object - especially to direct marketing.
- Rights around automated decision-making.
Traps
- Erasure is not absolute. Legal retention obligations or overriding grounds can block it.
- Portability is narrower than access. It applies only to data provided by the subject, processed by consent or contract, and by automated means.
- Deadlines. Requests must normally be answered within a set period (commonly one month), extendable for complex cases.
- Identity verification is allowed before fulfilling a request - but you cannot demand excessive proof to stall.
Worked example
A customer asks a retailer to delete their account data. The retailer must erase what it no longer needs, but may keep invoice records for the statutory tax period and must explain why. Rule of thumb: grant the right unless a specific legal exception applies, and always tell the person the outcome and reasoning.