Data Subject Rights and Request Handling
Rights typically include access, rectification, erasure, restriction, portability, objection, and rights around automated decision-making. Learn the trigger, the scope, the exceptions, and the clock. Most regimes impose a one-month response window (extendable for complex requests), with identity verification permitted but not used as a stalling tactic.
Access covers confirmation, a copy of the data, and specified metadata (purposes, categories, recipients, retention, rights, source, logic of automated decisions). Erasure is not absolute: legal retention obligations, legal claims, and freedom of expression can block it. Portability applies only to data provided by the individual, processed by consent or contract, and by automated means - it is narrower than access. Objection to direct marketing is absolute; objection to other processing requires a compelling-legitimate-grounds test. Restriction freezes processing but keeps the data.
Traps
- Treating every request as access. Read the request's substance, not its label.
- Forgetting that third-party rights (confidentiality) can justify redaction.
- Ignoring the difference between erasure and restriction.
- Missing that portability does not cover inferred or derived data.
Rule of thumb
Use V-C-S-R: Verify identity, Clarify scope, Search systems, Respond within the deadline with a documented rationale for any refusal or redaction.
Worked example: A customer asks to "delete everything." You identify an open complaint where data is needed for legal claims. You erase what you can, apply restriction to the litigation-hold data, and explain the exception clearly within the deadline.