GDPR Chapter III (Articles 12–23) creates eight enforceable rights for individuals. Businesses acting as data controllers are on the hook for all of them. Failing to respond, responding late, or responding incompletely are all enforcement triggers — and the fines, particularly for Subject Access Request failures, have become routine.
The 8 GDPR Data Subject Rights at a Glance
| Right | GDPR Article | Time Limit | Applies When | Common Exemptions |
|---|---|---|---|---|
| Right to be informed | Arts. 13–14 | At point of collection | Always | None significant |
| Right of access (SAR) | Art. 15 | 30 days (extendable to 3 months) | Always | Legal privilege, third-party data, some national exemptions |
| Right to rectification | Art. 16 | Without undue delay | Data is inaccurate or incomplete | None significant |
| Right to erasure | Art. 17 | Without undue delay | Data no longer needed, consent withdrawn, unlawful processing | Legal obligation, legal claims, public interest |
| Right to restrict processing | Art. 18 | Without undue delay | Accuracy contested, processing unlawful, legal claims | None significant |
| Right to data portability | Art. 20 | 30 days | Consent or contract basis only | Does not apply to LI or legal obligation |
| Right to object | Art. 21 | Immediately effective | Direct marketing (absolute), LI processing | Compelling legitimate grounds for non-direct-marketing objections |
| Rights re automated decisions | Art. 22 | Within 1 month | Solely automated decision with legal/significant effect | Legal authorisation, explicit consent |
Right 1: Right to Be Informed (Articles 13–14)
Data subjects must be informed of how their data is used — the what, why, how long, and who. Article 13 applies when data is collected directly from the individual (e.g., a contact form); Article 14 applies when data is obtained from a third-party source (e.g., a purchased list, or data shared by a partner).
What your privacy policy must include:
- Identity and contact details of the controller
- Contact details of the DPO (if appointed)
- Purposes and legal basis for each processing activity
- Legitimate interests being pursued (if relying on Art. 6(1)(f))
- Recipients or categories of recipients
- Transfers to third countries and the safeguards applied
- Retention periods
- All data subject rights (the full list, including the right to withdraw consent)
- Right to lodge a complaint with a supervisory authority
The timing rule for Article 13 is clear: the privacy notice must be provided at the time of collection, not buried in a footer link the user must go looking for.
Right 2: Right of Access — Subject Access Requests (Article 15)
A Subject Access Request (SAR) entitles an individual to receive confirmation of whether you process their personal data, and if so, a copy of all of it. This is the right that generates the most enforcement activity.
What you must provide:
- Confirmation that processing occurs (or does not)
- A copy of all personal data held
- The purposes of processing
- The categories of data
- Recipients or categories of recipients
- The envisaged retention period
- Information about the data subject's rights to rectification, erasure, and objection
- The right to lodge a complaint with a supervisory authority
- Source of the data if not collected directly from the subject
- Information about any automated decision-making or profiling
The 30-day clock starts when you receive the request — not when you respond to acknowledge it. Requests received by any channel (email, post, social media, phone) count; you cannot require a specific form.
SAR Workflow
- Receive — note the date; the 30-day period begins immediately
- Acknowledge — respond within 3 working days to confirm receipt and identity verification method
- Verify identity — proportionate to the sensitivity of the data; do not over-collect
- Compile data — search all systems: CRM, email, support tickets, databases, backups, spreadsheets
- Review for third-party data — redact information about others that cannot be disclosed
- Apply exemptions — document any exemptions relied on and the reasoning
- Respond — provide data in a commonly used electronic format within 30 days
- Extend if needed — for complex or numerous requests, you may extend to 3 months; notify the requester within the original 30-day period, explaining why
Right 3: Right to Rectification (Article 16)
If a data subject demonstrates that data you hold about them is inaccurate or incomplete, you must correct it without undue delay. "Without undue delay" is not defined but is generally interpreted as within 30 days in the absence of complexity. You must also notify any third parties to whom you have disclosed the data, unless this is impossible or involves disproportionate effort.
Right 4: Right to Erasure — "Right to Be Forgotten" (Article 17)
Erasure applies in six specific circumstances:
- The data is no longer necessary for the purpose for which it was collected
- Consent is withdrawn and no other legal basis exists
- The data subject objects under Article 21 and you have no overriding legitimate grounds
- The data has been unlawfully processed
- Erasure is required to comply with a legal obligation
- The data concerns a child and was collected in connection with information society services
When erasure does not apply: Tax law requires retention of financial records (typically 7–10 years depending on jurisdiction). Employment law requires retention of HR records. Legal proceedings may require preservation of relevant data. In these cases you must inform the data subject of the legal basis for refusing erasure and delete what you can lawfully delete — typically behavioural, marketing, and preference data.
Right 5: Right to Restrict Processing (Article 18)
Restriction means you keep the data but stop using it — it is flagged as restricted and may only be stored, not processed. This applies while accuracy is contested, while the data subject's objection is assessed, or where the data subject needs data for legal claims even though you no longer need it. In practice this means marking records as restricted in your systems and ensuring they do not flow through marketing automation, analytics, or reporting pipelines.
Right 6: Right to Data Portability (Article 20)
Data portability applies only where the legal basis is consent or contract performance. It does not apply to processing based on legitimate interest or legal obligation. The data must be provided in a structured, commonly used, machine-readable format (CSV or JSON both satisfy this requirement). You must provide the data about the requesting individual — not data about third parties that happens to mention them.
Right 7: Right to Object (Article 21)
The right to object operates differently depending on what the data subject is objecting to:
- Direct marketing: The right is absolute. You must stop processing for direct marketing purposes immediately and unconditionally when an individual objects. No balancing test applies.
- Processing based on legitimate interest or public task: The right still applies, but you may continue processing if you can demonstrate compelling legitimate grounds that override the individual's interests, rights, and freedoms — or where processing is necessary for legal claims.
Your privacy policy must clearly explain both dimensions of this right.
Right 8: Rights Related to Automated Decision-Making (Article 22)
Article 22 restricts purely automated decisions that produce legal effects or similarly significant effects on individuals — credit scoring, automated job application rejection, insurance pricing with no human review. If you carry out such processing, you must ensure either that explicit consent is obtained, it is necessary for a contract, or it is authorised by EU/member state law. In all cases, data subjects must be able to request human review, express their point of view, and contest the decision.
Enforcement in Practice
The UK ICO has issued enforcement notices against organisations across healthcare, financial services, and the public sector for SAR non-compliance. Notable cases include enforcement notices against Clearview AI (which also failed to respond to SARs), and monetary penalties issued to councils, GP practices, and recruitment agencies for ignoring requests. Under GDPR Article 83(4), failures to facilitate data subject rights can attract fines of up to €10 million or 2% of global annual turnover. Where the failure also amounts to processing without a lawful basis, the Article 83(5) scale of €20 million or 4% applies.
Build a privacy policy that fully discloses all eight data subject rights and explains how individuals can exercise them at /gdpr-privacy-policy-generator.