GDPR data subject rights, and answering requests on time.

1. 13–14
   To be informedA clear privacy notice at collection.
2. 15
   Of accessConfirmation and a copy of their data, plus context.
3. 16
   To rectificationInaccurate or incomplete data corrected.
4. 17
   To erasureThe “right to be forgotten”, in defined circumstances.
5. 18
   To restrict processingProcessing paused, for example while accuracy is disputed.
6. 20
   To data portabilityData in a structured, machine-readable format.
7. 21
   To objectTo legitimate-interests processing; absolute for direct marketing.
8. 22
   On automated decisionsNot subject to solely automated decisions with legal or similar effects.

• A copy of the data
• Purposes
• Categories of data
• Recipients
• Retention period
• Their other rights
• Right to complain
• Source of the data
• Automated decision-making

• Verify identity. Never disclose data to the wrong person.
• Search everywhere. Databases, email, tickets, backups and processors.
• Redact others. Remove other people's personal data.
• Answer within a month. Extend by two more only for complex or numerous requests, and say why.
• Record it. Log the request and your response for accountability.

Illustrative: a former customer emails a general support address asking for everything held about them and for it all to be deleted. Nobody labels it a request, but it is one. It must be logged the day it arrives, because the one-month period runs from then.

1. Log it, date it, and name one owner.
2. Confirm identity with the least data needed.
3. Split it: the access part and the erasure part follow different tests.
4. Search every system and ask each processor to search theirs.
5. Check the erasure exceptions, such as a legal duty to keep invoices.
6. Reply with the copy, the context, and a plain reason for anything kept.

• Treating email as informal. Requests can arrive by any channel, in any wording.
• Forgetting to tell recipients. Rectification, erasure and restriction must be passed on to those who received the data.
• Silent refusals. A refusal must say why and mention the right to complain.
• Over-collecting ID. Demanding a passport for a newsletter request is disproportionate.

The Digital Personal Data Protection Act, 2023 gives a data principal rights of access to information, correction and erasure, grievance redressal and nomination. It has no portability right. A single request log, one identity check and one search routine can serve both laws, with the response time and exceptions set per law.

• Data principal rights, and running requestsThe rights people hold, and a workflow that answers them.
• Grievance redressal and the contact pointWho people write to, and how complaints are handled.

Sources: Regulation (EU) 2016/679, Articles 12 to 22; EDPB Guidelines 01/2022 on the right of access; Digital Personal Data Protection Act, 2023. This page is general information, not legal advice; counsel should confirm how it applies to your contracts.