The GDPR is one of the most robust global privacy laws in effect today. Created by the European Union (EU) and put into effect in 2018, the GDPR outlines certain obligations organizations must follow, limiting how personal data can be used. A crucial part of the GDPR is the data subject rights it grants an individual regarding personal data usage. Ultimately, the rights give individuals more autonomy over their personal information and how it’s used.

What are the GDPR data subject rights?

The General Data Protection Regulation (GDPR) outlines 8 fundamental data subject rights, plus the right to withdraw consent, which guarantees individual autonomy over both personal data and its processing.  Let’s take a deeper look at each of the GDPR data subject rights:

• Right to be informed (GDPR Articles 12 to 14): Data subjects have the right to be informed about the collection and use of their personal data.
• Right to access (GDPR Article 15): Data subjects have the right to view and request copies of their personal data.
• Right to rectification (GDPR Article 16): Data subjects have the right to request inaccurate or outdated personal information be updated or corrected.
• Right to be forgotten/Right to erasure (GDPR Article 17): Data subjects have the right to request their personal data be deleted. Note that this is not an absolute right and may be subject to exemptions based on certain laws.
• Right to data portability (GDPR Article 20): Data subjects have the right to ask for their data to be transferred to another controller or provided to them. The data must be provided in a machine-readable electronic format.
• Right to restrict processing (Article 18): Data subjects have the right to request the restriction or suppression of their personal data.
• Right to withdraw consent (GDPR Article 7): Data subjects have the right to withdraw previously given consent to process their personal data.
• Right to object (GDPR Article 21): Data subjects have the right to object to the processing of their personal data.
• Right to object to automated processing (GDPR Article 22): Data subjects have the right to object to decisions being made with their data solely based on automated decision making or profiling.

OneTrust launched the first-to-market Data Subject Access Request (DSAR) portal, allowing data subjects to submit requests directly to organizations that process their data. This allows organizations to demonstrate compliance and automate record-keeping by operationalizing the fulfillment of data subject requests. The comprehensive solution helps organizations comply with data subject requests made under the GDPR. Explore the portal and learn more!