Explainer: Take Action
Exercise your rights or get more information.
Know your rights
As the subject of data, you have certain rights. These data subject rights are absolute rights and may not be compromised by any organisation.
For a start you have the right to information. The organisation which processes your personal data has the obligation to be transparent on what they do with your personal data and inform you in a clear manner.
However, you also have rights you can actively claim when you want more information or feel you're being wronged by an organisation. In order to do so, you can always contact the organisation. They are required to respond to you within a month.
On this page, we will describe the different rights you have as a data subject.
Rights of data subjects
The GDPR states that a data subject, the person who is the subject of the personal data, has the right to clear information about what is done with his or her personal data.
In addition to the right to clear information, data subjects have other rights under the GDPR:
- The right of access to your personal data
- The right to rectification
- The right to erasure ('right to be forgotten')
- The right to restriction of processing
- The right to data portability (transferability of data)
- The right to object to the processing of personal data
- The right to express opinions, to challenge decisions and to have a human look at the decisions taken, by means of automated decisions.
An organisation must give substance to these rights of the data subjects. That is why it is required that an organisation has set up processes in order to be able to execute these rights.
Right to access
A data subject may have the right to inspect whether, and if so, which personal data are processed by an organisation. You, as a data subject, do not have to give a reason for this. You may also ask for a copy of these data.
Right to rectification
You have the right to ask an organisation to correct or update the personal data it processes about you if these data are incorrect. The GDPR states this must bedone 'without delay'.
Right to erasure
Also explained as the 'right to be forgotten'. A person may ask an organisation to delete his or her personal data. This is called the right to forget, or the right to erase data.
Right to restriction of processing
A data subject can limit the way an organisation uses their data. This is an alternative to the right to erasure. Data subjects can evoke this right if they have a particular reasoning for granting the restriction.
Right to data portability
A data subject may ask an organisation to transfer any personal information they have about him or her, to the data subject himself or to another organisation. The data must be provided in a common, structured and machine-readable form.
Right to object
Data subjects have the right to object to the processing of their own personal data and to ask an organisation to stop using these data. If personal data are processed under the principles of 'justified interest' or 'general interest', a data subject can always object to this.
Automated individual decision making
If an organisation makes an automatic decision when processing personal data, i.e.without human intervention, this is called an 'automated decision' or ‘profiling.’ A data subject shall have the right not to be subject to it if this produces legal effects or otherwise significantly affects them.