The eight rights of data subjects
Access, rectification, erasure, restriction, portability, objection, withdrawal, and protection against automated decisions. What each right means – and which deadlines run alongside.
The rights apply whether or not a contract exists or an account was created. They belong to every person whose data is processed – including a website visitor who never entered anything.
How often the rights are exercised in practice
- Access and a copy of the data45 %
- Erasure25 %
- Objection to marketing15 %
- Rectification10 %
- Portability and restriction5 %
The eight rights one by one
- Access (Art. 15). What data is held, for what, from where, to whom it goes, how long it stays – plus a copy of the data itself.
- Rectification (Art. 16). What is wrong gets corrected, what is incomplete gets completed. Applies to facts, not to assessments.
- Erasure (Art. 17). Where the purpose has lapsed, consent was withdrawn, or the processing was unlawful.
- Restriction (Art. 18). The freeze: the data stays but is no longer used – for example while accuracy is being checked.
- Portability (Art. 20). Handover in a machine-readable format. Applies only with consent or a contract and only to data the person provided.
- Objection (Art. 21). Against processing based on legitimate interests. For direct marketing, without reasons and without any balancing.
- Withdrawal (Art. 7(3)). At any time, going forward, as easy as giving consent was.
- Protection against automated decisions (Art. 22). Where the effect is legal or similarly significant, there is a right to human review.
The deadlines
The sequence after a request arrives
- at onceIdentity has to be checked – but only where doubts are justified, and never by demanding an ID document as standard.
- 1 monthThe standard deadline for the response. It applies to every right alike.
- +2 monthsExtension for particularly complex cases – permitted only if notice was given within the first month.
- after thatIf no answer comes, a complaint can be lodged with the supervisory authority – free of charge and without formalities.