Data Subject Rights and Consent Management
What to know
Know the rights: information, access, rectification, erasure, restriction, portability, objection, and rights relating to automated decision-making. Understand timelines (typically one month, extendable), verification of identity, manifestly unfounded or excessive requests, and permitted exemptions (legal claims, crime, confidentiality). For consent, know the validity test and the mechanics of withdrawal (as easy as giving), granularity (separate purposes), records of consent, and age-related rules for online services.
Traps
- Promising absolute erasure when exceptions apply (legal obligation, legal claims, freedom of expression).
- Confusing access (a copy of data plus context) with portability (structured, machine-readable, provided by the individual or observed).
- Treating a verbal request as invalid; requests can come by any means.
- Charging a fee by default; fees apply only for manifestly unfounded or excessive requests.
- Ignoring objection to direct marketing, which must be honoured absolutely.
Worked example
A customer emails: "Delete everything you hold on me." Rule of thumb: log the request, verify identity proportionately, search all systems, assess exemptions, respond within one month. If a statutory retention duty applies to invoice records, erase what you can and explain the retained categories and the reason. Do not simply refuse.
Rule of thumb
Rights are not absolute; each response is a reasoned decision: comply, partially comply with explanation, or refuse with justification and appeal route.