Rights of data subjects

A number of the rights currently applicable to individuals under the DPA have been strengthened under the GDPR, and some new rights have also been introduced. The rights are as follows (completely new rights in bold):

 

• The right to be informed
• The right of access – data subjects will have a right to request to see the personal data a controller holds about them. Under the GDPR, it will not usually be possible to charge for a response to such requests, and the timescale for response will be shortened to 30 days.
• The right to rectification
• The right to erasure (‘right to be forgotten’) – this right applies in specific circumstances, such as where consent for processing is withdrawn and there is no other legal basis for processing the data.
• The right to restrict processing
• The right to data portability – this right applies in specific circumstances, and allows the subject to request that the data held about them by a controller is moved to another controller.
• The right to object to processing.
• Rights in relation to automated decision making and profiling – see the ICO’s webpage on this for an explanation

 

Also see the ICO’s webpage on rights of data subjects, and Chapter 3 of the GDPR