What are data subject rights?
Data subject rights give every person whose data an organisation processes an enforceable claim. The person can find out what happens to their data and act on that processing.
The rights sit in Chapter III of Regulation (EU) 2016/679 (GDPR). Article 12 sets form and deadline, Articles 15 to 22 the individual rights and Article 23 the restrictions. How the rights fit with legal bases, records and breach duties is set out in the GDPR guide for organisations.
The information duties in Articles 13 and 14 GDPR are a separate matter. They arise when the data are collected, with no request needed. A data subject right is triggered only by the person's request.
Seven rights in Articles 15 to 22 GDPR
The GDPR grants seven rights that a person exercises by request. Article 19 is not a right of its own but a notification duty attached to three of them.
| Right | Provision | What it covers |
|---|---|---|
| Access | Article 15 | Confirmation, access to the data and a copy |
| Rectification | Article 16 | Correction of inaccurate data and completion of incomplete data, including by a supplementary statement |
| Erasure | Article 17 | Erasure as soon as one of the grounds in paragraph 1 applies, for example because the purpose has lapsed |
| Restriction of processing | Article 18 | The data stay stored but may be processed only in the cases set out in paragraph 2 |
| Data portability | Article 20 | Release of the data the person provided, in a structured, commonly used and machine-readable format |
| Objection | Article 21 | Objection to processing under Article 6(1)(e) or (f); against direct marketing with no balancing test |
| No purely automated decision | Article 22 | Protection from decisions based solely on automated processing that have legal or similarly significant effects |
Alongside these sit the withdrawal of consent under Article 7(3) and the complaint to a supervisory authority under Article 77. All seven rights run on the same Article 12 deadline, so a single intake process is enough if it recognises each of them.
Article 15 GDPR: confirmation, eight items and a copy
Article 15(1) GDPR gives the person the right to confirmation of whether data about them are being processed and, where that is the case, to access to the data and to eight items of information:
- the purposes of the processing (point (a))
- the categories of personal data concerned (point (b))
- the recipients or categories of recipient, in particular in third countries (point (c))
- the envisaged storage period or the criteria for it (point (d))
- the existence of the rights to rectification, erasure, restriction and objection (point (e))
- the right to lodge a complaint with a supervisory authority (point (f))
- the source of the data, where they were not collected from the person (point (g))
- automated decision-making including profiling, with meaningful information about the logic involved (point (h))
Where data are transferred to a third country, paragraph 2 adds information on the appropriate safeguards under Article 46. Under paragraph 3, the controller provides a copy of the data, in a commonly used electronic form where the request was made electronically.
What deadlines apply to data subject requests?
Article 12(3) GDPR requires the controller to respond without undue delay and at the latest one month after receiving the request.
| Step | Deadline | Provision |
|---|---|---|
| Response to the request | without undue delay, at the latest 1 month after receipt | Article 12(3), first sentence |
| Extension for complex requests or a high number of requests | by 2 further months | Article 12(3), second sentence |
| Notice of the extension, with reasons | within 1 month of receipt | Article 12(3), third sentence |
| Notice that no action will be taken, with reasons | without delay, at the latest 1 month after receipt | Article 12(4) |
The extension requires the person to be told about it within the first month. A refusal in whole or in part states the reasons. It also points to the complaint to a supervisory authority and to the judicial remedy. A person who makes the request electronically is informed electronically where possible (Article 12(3), fourth sentence).
Article 19: recipients learn of rectification and erasure
Article 19 GDPR requires the controller to communicate every rectification, erasure and restriction to each recipient to whom it disclosed the data. The only exception is where this proves impossible or involves disproportionate effort. If the person asks, the controller tells them who those recipients are.
The duty presupposes that the actual recipients are known. The record of processing under Article 30(1)(d) lists only categories of recipients and is not enough for this. A controller relying on disproportionate effort records its reasons, because Article 5(2) makes it accountable.
Can you ask for ID before answering an access request?
The controller may request additional information on identity only where it has reasonable doubts, and only as much as is needed to confirm it (Article 12(6) GDPR). A blanket ID check on every request is not covered by the provision. It also names only requests under Articles 15 to 21; Article 22 is not in its wording.
The European Data Protection Board considers an ID copy disproportionate where the person is already authenticated, for example through their customer account (Guidelines 01/2022 on the right of access, para. 73). As alternatives it names confirmation links by email or text message, security questions and confirmation codes (para. 75). An ID copy also collects additional data and so sits uneasily with data minimisation.
Six limits and what still applies
Every data subject right has a statutory limit, and none of them allows a request to go unanswered.
| Limit | Provision | What the controller must do |
|---|---|---|
| Rights and freedoms of others, such as trade secrets or copyright in software | Article 15(4), Recital 63 | Withhold the protected parts; refusing all information is ruled out |
| Large quantity of information about the person | Recital 63 | Ask the person to specify which information the request relates to |
| Statutory retention duty | Article 17(3)(b) | Do not erase data the retention duty covers; the retained data remain subject to access (EDPB, para. 109) |
| Portability only for consent or contract and automated processing | Article 20(1) | On any other legal basis only the right to portability lapses; Article 15 has no such condition |
| Manifestly unfounded or excessive requests | Article 12(5) | Charge a reasonable fee or refuse; the controller bears the burden of proof |
| Restrictions under Union or national law, in Germany in the Federal Data Protection Act (BDSG) | Article 23 | Assess each case to establish whether a restriction applies |
A limit justifies a partial answer with reasons.
How do you find all of a person's data?
An access request can be answered in full only once it is clear which systems hold the person's data. The starting points are the record of processing activities, the system inventory and the list of processors. Check these locations as well as the primary system:
- exports into spreadsheets and reporting databases
- employees' personal mailboxes and file stores
- ticketing and recruitment systems
- log data
- test environments holding production data
- backups
For processing on behalf of a controller, Article 28(3)(e) requires a contract under which the processor assists the controller in answering data subject requests. Set out the contact point, response time and delivery format in it. The one-month deadline keeps running while you wait for the processor.
Personal data in the Rizzqo asset register
Rizzqo's asset register models which systems hold personal data, which defines the search space for an access request under Article 15 GDPR. Primary assets such as information, services and business processes carry the personal-data flag. The secondary assets that support them, such as software, servers and cloud services, inherit this flag and the confidentiality rating. The owner recorded on the asset compiles the data from that system for the response.