Data Subject Rights under the GDPR: Access, Correction, Erasure
Since May 25, 2018, the General Data Protection Regulation (GDPR) has applied directly in all EU member states. It grants affected people a number of rights. Anyone who wants to know what data a company, an agency or another body has stored about them can ask for access. Depending on the situation, data subjects can also demand that data be corrected or, in certain cases, deleted.
Does the responsible body have to answer every such request, and what deadline applies? This article explains which rights the regulation provides, how the process works and where to turn if no answer comes.
Which Rights Does the GDPR Give?
The regulation lists several separate rights, each set out in its own article. Article 15 covers the right of access, Article 16 the right to rectification, Article 17 the right to erasure and Article 18 the right to restriction of processing. On top of these come the right to data portability in Article 20 and the right to object in Article 21.
Using the right of access is usually the first step. It clarifies whether and which data the responsible body is processing about a person. On that basis, data subjects can judge whether they want to demand correction of wrong details, restriction of processing or erasure. Each of these rights serves a different purpose. Which one applies depends on the situation.
The rights are not unlimited, though. Article 17, paragraph 3 contains exceptions to the right to erasure. The responsible body therefore does not always have to comply with a request for deletion. A refusal does not automatically mean that it is breaking the rules.
What Deadline Applies to the Answer?
Under Article 12, paragraph 3, the responsible body must report without undue delay, and in any case within one month of receiving the request, which measures it has taken. This basic period can be extended by another two months if that is necessary because of the complexity or the number of requests. The person concerned must be told about the extension and its reasons within one month.
Information and measures on request are generally free of charge. Anyone who uses their rights under the GDPR normally does not have to pay for it. If no answer arrives after a month, that is not always a violation: in the meantime the body may have announced an extension. It is therefore worth checking whether such a notice has come in.
What to Do if a Request Is Refused or Goes Unanswered
If the responsible body turns down the request or does not answer on time, data subjects have further options. Anyone who believes that the processing of their data breaks the rules can lodge a complaint with a supervisory authority under Article 77 of the GDPR. In Germany, Section 19 of the Federal Data Protection Act (BDSG) adds to this rule. National provisions can also narrow the scope of individual rights: for the right of access and the right to erasure, Germany applies additional limits under Sections 34 and 35 of the BDSG.
Data subject rights form a connected system. It runs from access through correction and erasure to a complaint to the supervisory authority. Anyone who knows Articles 15 to 21 and the deadlines in Article 12 can better judge whether an answer meets the requirements of the GDPR. This article gives a general overview and does not replace legal advice.