Chapter 3. Rights of the Data Subject (Articles 12-23)

This chapter discusses the rights of the data subject, including the right to be forgotten, right to rectification, and right to restriction of processing.

Section 1 – Transparency and Modalities

Article 12 – Transparent information, communication and modalities for the exercise of the rights of the data subject

When necessary, the controller must provide information in a concise, transparent, intelligible and easily accessible form, using clear and plain language, and the controller needs to provide information on action taken on request by and to the data subject within one month.

Section 2 – Information and Access to Personal Data

Article 13 – Information to be provided where personal data are collected from the data subject

When personal data is collected from the data subject, certain information needs to be provided to the data subject.

Article 14 – Information to be provided where personal data have not been obtained from the data subjec

When personal data is not obtained from the data subject, the controller has to provide the data subject with certain information.

Article 15 – Right of access by the data subject

The data subject has a right to know whether their personal data is being processed, what data is being processed, etc.

Section 3 – Rectification and Erasure

Article 16 – Right to rectification

The data subject can require the controller to rectify any inaccurate information immediately.

Article 17 – Right to erasure ("right to be forgotten")

In some cases, the data subject has the right to make the controller erase all personal data, with some exceptions.

Article 18 – Right to restriction of processing

In some cases, the data subject can restrict the controller from processing.

Article 19 – Notification obligation regarding rectification or erasure of personal data or restriction of processing

The controller has to notify recipients of personal data if that data is rectified or erased.

Article 20 – Right to data portability

The data subject can request to receive their personal data and give it to another controller or have the current controller give it directly to another controller.

Section 4 – Right to Object and Automated Individual Decision-making

Article 21 – Right to object

Data subjects have the right to object to data processing on the grounds of his or her personal situation.

Article 22 – Automated individual decision-making, including profiling

Data subjects have the right not to be subjected to automated individual decision-making, including profiling.

Section 5 – Restrictions

Article 23 – Restrictions

Union or Member State law can restrict the rights in Articles 12 through 22 through a legislative measure.

References

• GDPR Home

• GDPR Chapters

• GDPR Recitals

• GDPR Key Issues