Data subject rights

The rights the GDPR gives individuals whose data is processed: the right to information, access, rectification, erasure (the right to be forgotten), restriction of processing, data portability and objection — plus protection against purely automated decisions with significant effects. The company must have procedures so requests are answered within one month. The rights are not absolute; erasure can for example be refused if the data must be retained under bookkeeping law. Poor handling of these rights is one of the most common causes of complaints to data protection authorities.