Data Subject Rights (Overview)
Art. 12-22 GDPR — the 8 rights
TL;DR
The 8 data subject rights: information, access, rectification, erasure, restriction, objection, data portability, automated decision-making. Response deadline 1 month (extendable to 3).
What are the data subject rights (overview)?
The 8 rights:
- Information (Art. 13/14)
- Access (Art. 15)
- Rectification (Art. 16)
- Erasure (Art. 17)
- Restriction (Art. 18)
- Data portability (Art. 20)
- Objection (Art. 21)
- Automated decision-making (Art. 22)
Practical example
An employee requests access to all stored data. Response within 1 month: an extract from the record of processing activities, the categories of data, the recipients and the retention period.
Frequently asked questions
What is the deadline?
1 month from receipt. An extension by 2 months is possible (complex cases).
Is there a charge?
The first response is free of charge. For manifestly unfounded or excessive requests, a fee is possible.
See also
Practitioner note: This article is practice-oriented compliance documentation, not legal advice. We are compliance specialists, not a law firm. For legally binding advice, consult an admitted lawyer.