Do you Have a Summary of My Rights Under the GDPR?

Summary of Individual Rights Under the General Data Protection Regulation

Request access to personal data (commonly known as a "data subject access request"). This enables an individual to receive a copy of the personal data held by the data controller about an individual and to check that such personal data has been lawfully processed.

Request correction of the personal data that is held about an individual. This enables an individual to have any incomplete or inaccurate data held corrected, though the accuracy of any new data an individual may provide may have to be verified.

Request erasure of personal data. This enables an individual to ask a data controller to delete or remove personal data where there is no good reason for us continuing to process it. An individual also has the right to ask for such personal data to be deleted or removed where an individual has successfully exercised its right to object to processing (see below), where personal data may have processed unlawfully, or where required to erase personal data to comply with local law. Note, however, that it may not always be possible to comply with a request of erasure for specific legal reasons, which will be notified to an individual, if applicable, at the time of the request.

Object to processing of personal data where a data controller is relying on a legitimate interest (or those of a third party) and there is something about the individual’s particular situation which makes an individual want to object to processing on this ground as an individual feel it impacts on their fundamental rights and freedoms. An individual also has the right to object where processing of personal data for direct marketing purposes is taking place. In some cases, it may be demonstrated that the data controller has compelling legitimate grounds to process information which override the individual’s rights and freedoms.

Request restriction of processing of personal data. This enables an individual to ask a data controller to suspend the processing of personal data in the following scenarios: (a) if an individual want the data controller to establish the data's accuracy; (b) where the data controller’s use of the data is unlawful but an individual does not want it erased; (c) where an individual needs the data to be held even if it is no longer required but an individual needs it to establish, exercise or defend legal claims; or (d) an individual has objected to the use of its data but it is needed to verify whether the data controller has overriding legitimate grounds to use it.

Request the transfer of personal data to an individual or to a third party. The data will be provided to an individual, or a third party an individual has chosen, in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which an individual initially provided consent for a data controller to use or where the information was used to perform a contract with an individual.

Withdraw consent at any time where the data controller is relying on consent to process personal data. However, this will not affect the lawfulness of any processing carried out before an individual withdraws consent. If an individual withdraws consent, the data controller may not be able to provide certain products or services to an individual. The data controller will advise an individual if this is the case at the time an individual withdraws their consent.