Last updated: 5 November 2026

The GDPR gives individuals eight core rights over their personal data: to be informed, to access it, to have it corrected, to have it erased, to restrict its use, to move it to another provider, to object, and to protections against solely automated decisions. Organisations must normally act on a request within one month, free of charge, and each right has its own conditions and exemptions. This guide explains every GDPR right in plain English, with the article number, what you must do, when you can refuse, and how the same right works under UK GDPR, South Africa's POPIA and the California CCPA.

If you only need the access right, our guide to handling a data subject access request (DSAR) goes deeper on that one process. This page is the hub for all of them.

The 8 GDPR rights at a glance

# Right GDPR article What the individual can ask for Main limits
1 Right to be informed Arts 13 and 14 Clear information about who processes their data, why, on what lawful basis, for how long and who receives it Limited exceptions in Art 14(5) when data was not collected from the person
2 Right of access Art 15 Confirmation that data is processed, a copy of it and supporting information Must not adversely affect the rights and freedoms of others
3 Right to rectification Art 16 Correction of inaccurate data and completion of incomplete data Only applies to inaccurate or incomplete data
4 Right to erasure ("right to be forgotten") Art 17 Deletion of their data Only on one of six grounds; five exceptions, including legal obligations and legal claims
5 Right to restriction of processing Art 18 That data is kept but not otherwise used Only on one of four grounds
6 Right to data portability Art 20 Their data in a structured, machine-readable format, or sent directly to another controller Only for consent or contract processing carried out by automated means
7 Right to object Art 21 That processing based on public task or legitimate interests stops; absolute right for direct marketing Controller can continue if it shows compelling legitimate grounds or needs the data for legal claims (not for direct marketing)
8 Rights related to automated decision-making Art 22 Not to be subject to a decision based solely on automated processing with legal or similarly significant effects Allowed where necessary for a contract, authorised by law or based on explicit consent, with safeguards

Two further rights sit alongside these and come up in almost every privacy programme: the right to withdraw consent at any time (Art 7(3)), which must be as easy as giving it, and the right to lodge a complaint with a supervisory authority (Art 77), backed by the rights to a judicial remedy (Art 79) and to compensation for material or non-material damage (Art 82).

The rules that apply to every GDPR right

Article 12 sets the common procedure for all data subject requests. Get these rules into your process once and they work for every right.

  • Deadline. Respond without undue delay and in any event within one month of receiving the request. You can extend by two further months where necessary, taking into account the complexity and number of requests, but you must tell the person within the first month and give reasons.
  • Cost. Acting on a request is free of charge. Where requests are manifestly unfounded or excessive, in particular because they are repetitive, you may charge a reasonable fee or refuse, but you bear the burden of showing why.
  • Identity. If you have reasonable doubts about who is making the request, you may ask for additional information needed to confirm their identity. Ask only for what you need; asking a known customer for a passport copy is rarely proportionate.
  • Form. Information must be concise, transparent, intelligible and easily accessible, in clear and plain language. A request made electronically should usually be answered electronically.
  • If you refuse. Tell the person within one month why you are not acting and that they can complain to a supervisory authority and seek a judicial remedy.
  • Telling recipients. Under Article 19, when you rectify, erase or restrict data you must pass that on to each recipient you disclosed it to, unless that proves impossible or involves disproportionate effort, and tell the person who those recipients are if they ask. In practice this means your vendors and processors.

Failing to honour these rights is serious. Infringements of the data subject rights in Articles 12 to 22 fall in the higher fine tier under Article 83(5)(b): up to EUR 20 million or 4% of total worldwide annual turnover of the preceding financial year, whichever is higher.

Each GDPR right explained

1. The right to be informed (Articles 13 and 14)

People have the right to know what you do with their data before or shortly after you collect it. Where you collect data directly from the person, Article 13 requires you to give the information at the time of collection. Where you obtain it from someone else, Article 14(3) requires it within a reasonable period, at the latest within one month (earlier if you contact the person or disclose the data to someone else first).

What it means in practice: a privacy notice that lists your identity and contact details, the purposes and lawful basis for each processing activity, recipients, international transfers, retention periods, the other rights on this page, and the right to complain. The notice must match what you actually do, which is why it should be built from your record of processing activities rather than written from memory.

2. The right of access (Article 15)

The person can ask whether you process their data and, if so, receive a copy plus supporting information: purposes, categories of data, recipients, retention period, source, and whether automated decision-making is involved. The first copy is free; for further copies you may charge a reasonable fee based on administrative costs. Article 15(4) says the right to a copy must not adversely affect the rights and freedoms of others, which is the basis for redacting third-party data.

The European Data Protection Board's Guidelines 01/2022 on the right of access (adopted in final form on 28 March 2023; the current version 2.1 adds minor corrections) are the most detailed official reading of this right. Our DSAR guide covers the full process, including search, redaction and a reply template.

3. The right to rectification (Article 16)

People can have inaccurate data corrected without undue delay, and incomplete data completed, including by providing a supplementary statement, taking into account the purposes of the processing.

What it means in practice: decide which system is the source of truth for each data field, correct it there, and let the correction flow to downstream systems and recipients (Article 19). Where accuracy is disputed, the person can also ask you to restrict processing while you check (see right 5).

4. The right to erasure, or "right to be forgotten" (Article 17)

This is not an absolute right to deletion. Article 17(1) applies only where one of six grounds is met:

  1. The data is no longer necessary for the purpose it was collected for.
  2. The person withdraws consent and there is no other lawful basis.
  3. The person objects under Article 21(1) and there are no overriding legitimate grounds, or objects to direct marketing under Article 21(2).
  4. The data has been unlawfully processed.
  5. Erasure is needed to comply with a legal obligation.
  6. The data was collected in relation to information society services offered to a child under Article 8(1).

Article 17(3) then lists five exceptions where you do not have to erase: exercising freedom of expression and information; complying with a legal obligation or performing a task in the public interest; public health; archiving, research or statistics in the public interest (where erasure would seriously impair those objectives); and the establishment, exercise or defence of legal claims.

If you made the data public, Article 17(2) also requires you to take reasonable steps, including technical measures, to inform other controllers processing it that the person has asked for erasure of links, copies or replications.

What it means in practice: erasure requests fail most often in backups, analytics tools, CRM exports and vendor systems. Your data map should tell you every place a person's data lives and which vendors to instruct.

5. The right to restriction of processing (Article 18)

Restriction means you keep the data but stop using it, other than storing it, unless the person consents or another listed purpose applies. It applies where:

  1. The person contests the accuracy of the data, for the period you need to verify it.
  2. The processing is unlawful but the person prefers restriction to erasure.
  3. You no longer need the data but the person needs it for legal claims.
  4. The person has objected under Article 21(1) and you are checking whether your legitimate grounds override theirs.

What it means in practice: you need a way to flag records as restricted so that marketing, analytics and automated workflows skip them. Many organisations discover they have no such flag until the first request arrives.

6. The right to data portability (Article 20)

People can receive the data they provided to you in a structured, commonly used and machine-readable format, and have it sent directly to another controller where technically feasible. It applies only where both conditions are met: the processing is based on consent or on a contract, and it is carried out by automated means. It does not apply to paper records, or to data processed under legitimate interests or a legal obligation.

What it means in practice: CSV or JSON exports of account data, transaction history and preferences. Portability overlaps with access, but the output must be reusable, not a PDF.

7. The right to object (Article 21)

People can object at any time to processing based on public task (Article 6(1)(e)) or legitimate interests (Article 6(1)(f)), including profiling. You must stop unless you can demonstrate compelling legitimate grounds that override their interests, rights and freedoms, or you need the data for legal claims.

Objection to direct marketing is absolute: once someone objects, their data must no longer be processed for that purpose, including related profiling. Article 21(4) requires that this right is explicitly brought to the person's attention at the latest at the time of your first communication, presented clearly and separately from other information.

What it means in practice: an unsubscribe link handles email, but a direct-marketing objection should suppress the person across all channels, including ad audiences built from your customer lists. If you rely on legitimate interests, your legitimate interests assessment should already record why your grounds could override an objection.

8. Rights related to automated decision-making and profiling (Article 22)

People have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects or similarly significant effects on them. Recital 71 gives the automatic refusal of an online credit application and e-recruiting without human intervention as examples.

Article 22(2) allows such decisions where they are necessary for entering into or performing a contract, authorised by Union or Member State law with suitable safeguards, or based on explicit consent. Where the decision relies on contract or explicit consent, the controller must at least give the person the right to obtain human intervention, to express their point of view and to contest the decision.

What it means in practice: list every model or rule set that makes decisions about people without a human in the loop, and record which Article 22(2) condition applies. This overlaps with AI governance: an AI inventory and a data map are two views of the same systems.

When you can restrict or refuse a request

Beyond the exceptions written into each article, Article 23 lets Union or Member State law restrict the rights in Articles 12 to 22 and 34, where the restriction respects the essence of the rights and is necessary and proportionate for listed objectives such as national security, crime prevention or the protection of others. National exemptions therefore differ between EU countries, and in the UK they sit in Schedules 2 to 4 of the Data Protection Act 2018.

Common lawful reasons to say no, or to say "partly":

Situation Typical basis What to do
Request is manifestly unfounded or excessive Art 12(5) Refuse or charge a reasonable fee; record your reasoning
Disclosing would reveal another person's data Art 15(4) Redact, or seek consent from the third party
You must keep the data by law (tax, employment, AML records) Art 17(3)(b) Refuse erasure for those records; restrict other uses; explain the retention period
Data is needed for an ongoing dispute Art 17(3)(e), Art 21(1) Keep what is needed for the claim; erase or restrict the rest
Processing is not based on consent or contract Art 20(1) Portability does not apply; consider handling as an access request
National law exemption Art 23 and national law Cite the specific provision; apply it narrowly

Whatever the outcome, respond within the deadline and tell the person about their right to complain.

How GDPR rights compare with UK GDPR, POPIA and CCPA

Most organisations with customers in more than one jurisdiction run one rights process with local variations. Most ranking guides stop at the GDPR. The table below shows the main differences.

Right GDPR (EU) UK GDPR POPIA (South Africa) CCPA/CPRA (California)
Informed Arts 13 and 14 Same Notification under s18 Notice at collection
Access Art 15 Same, with reasonable and proportionate search (Art 15(1A)) s23, using the PAIA request procedure (s25) Right to know
Correction Art 16 Same s24 Right to correct
Erasure Art 17 Same s24 (deletion or destruction) Right to delete
Restriction Art 18 Same No standalone equivalent No equivalent
Portability Art 20 Same No standalone equivalent No standalone right
Object Art 21 Same s11(3), and consent rules for electronic direct marketing in s69 Right to opt out of sale or sharing; right to limit use of sensitive personal information
Automated decisions Art 22 Replaced by Arts 22A to 22D s71 No GDPR-style statutory right; see CPPA regulations
Standard response time 1 month, extendable by 2 months 1 month, extendable by 2 months; clock can pause for clarification (Art 12A) Reasonable time; PAIA sets 30 days for access requests to private bodies 45 calendar days, extendable once by 45 days; opt-outs within 15 business days
Complaint route Supervisory authority (Art 77) Controllers must handle complaints themselves (s103 DUAA); then the ICO Information Regulator (s74); civil action (s99) California Privacy Protection Agency and Attorney General

UK GDPR after the Data (Use and Access) Act 2025

The UK kept the same eight rights but the Data (Use and Access) Act 2025 changed how some of them work:

  • Reasonable and proportionate searches. Section 78 adds Article 15(1A): the person is entitled to the information you can provide based on a reasonable and proportionate search. It took effect at Royal Assent on 19 June 2025 and is treated as in force from 1 January 2024.
  • Stop the clock. Section 76 adds Article 12A. The time between asking the person for information you reasonably need to identify the data they want and receiving it does not count towards the deadline. In force from 5 February 2026.
  • Automated decisions. Section 80 replaces Article 22 with new Articles 22A to 22D, which change when solely automated decisions are permitted and which safeguards apply. Fully in force from 5 February 2026. Read the ICO's commencement statement before relying on the new rules.
  • Complaints to the controller. Section 103 requires controllers to facilitate data protection complaints, for example with a complaint form that can be completed electronically, to acknowledge them within 30 days and to respond without undue delay. In force from 19 June 2026, as the ICO confirmed.

POPIA in South Africa

Section 5 of POPIA lists the data subject's rights and points to the sections that give them effect: notification (s18), notice of security compromises (s22), access (s23), correction and deletion (s24), objection (s11(3)), protection from unsolicited electronic direct marketing (s69), protection from automated decision-making (s71), complaints to the Information Regulator (s74) and civil proceedings (s99).

Two practical differences for teams used to the GDPR. First, POPIA has no standalone portability or restriction right, though correction, deletion and objection cover much of the same ground. Second, section 11(3) lets a person object at any time, on reasonable grounds, to processing based on legitimate interests or public law duties, and to direct marketing; and section 69 requires consent for electronic direct marketing unless the person is an existing customer being offered similar products with an opportunity to object. See our POPIA compliance guide for the wider picture.

CCPA/CPRA in California

The California Privacy Protection Agency lists the consumer rights as the rights to know, delete, correct, opt out of the sale or sharing of personal information, limit the use and disclosure of sensitive personal information, and equal treatment (no discrimination or retaliation for exercising rights). Businesses must respond to requests to know, delete and correct within 45 calendar days, extendable by a further 45 days with notice, and must comply with opt-out requests as soon as feasibly possible and no later than 15 business days (11 CCR 7026(f)). Our CalPrivacy explainer covers the state's newer data broker deletion mechanism.

How to handle any data subject rights request: 7 steps

This process works for every right. Only step 4 changes depending on what the person asks for.

  1. Log the request on the day it arrives. Requests do not have to use a form or quote the law. An email to customer support saying "delete my account and stop emailing me" is an erasure request and an objection to direct marketing. Record the date received, channel, jurisdiction and every right invoked.
  2. Confirm identity proportionately. Use information you already hold (a login, a reply from the registered email) before asking for documents. Under UK GDPR, record when you asked for clarification, since the clock can pause.
  3. Find the data. Use your data map to list every system, file share and vendor holding the person's data. This is where most deadlines are lost.
  4. Apply the right. Access: compile and redact. Rectification: correct at source. Erasure: check the six grounds and five exceptions, then delete or anonymise. Restriction: flag records. Portability: export in a machine-readable format. Objection: weigh your grounds, or stop direct marketing immediately. Automated decisions: arrange human review.
  5. Instruct recipients. Tell processors and other recipients about any rectification, erasure or restriction (Article 19), and get confirmation back. Your vendor risk assessments should already confirm each processor can support this.
  6. Respond in writing. Say what you did, what you did not do and why, the legal basis for any refusal, and how to complain to the regulator.
  7. Keep evidence. Store the request, identity checks, decisions, response and dates. If a regulator asks how you handle rights, this log is your answer, and repeated requests are easier to judge as excessive when you have the history.

Worked example: one email, four rights

Illustrative scenario. A customer of an online retailer with customers in Ireland, the UK and South Africa emails: "Please delete all my data and stop sending me marketing. Also, why was my account flagged for fraud?"

Element of the request Right invoked Decision Reason
"Stop sending me marketing" Objection to direct marketing (Art 21(2)-(3); POPIA s11(3)(b)) Stop immediately across email, SMS and ad audiences Absolute right, no balancing test
"Delete all my data" Erasure (Art 17) Delete profile, preferences and browsing history; keep invoices Invoices must be kept for tax law (Art 17(3)(b)); restrict them to that purpose
Open refund dispute Erasure exception Keep the dispute file until it closes Legal claims exception (Art 17(3)(e))
"Why was my account flagged?" Access (Art 15) and automated decisions (Art 22) Provide the data and meaningful information about the logic; offer human review Flag was generated by an automated fraud score that blocked checkout

The retailer logs one request with four parts, replies within one month, tells its email platform and ad partners to delete or suppress the data, and records the retention period for the invoices in its reply. Handling this as one "delete" ticket would have missed the access and automated-decision questions entirely.

Frequently asked questions

What are the 8 rights under GDPR?

The right to be informed, the right of access, the right to rectification, the right to erasure, the right to restrict processing, the right to data portability, the right to object, and rights in relation to automated decision-making and profiling. They are set out in Articles 13 to 22.

How long do you have to respond to a GDPR rights request?

One month from receipt, without undue delay. You can extend by two further months for complex or numerous requests if you tell the person within the first month and explain why. California allows 45 days plus a 45-day extension; POPIA requires a reasonable time, with PAIA setting 30 days for access requests to private bodies.

Is the right to be forgotten absolute?

No. Erasure applies only on one of the six grounds in Article 17(1), and Article 17(3) lists exceptions, including where you must keep the data to comply with a legal obligation or need it for legal claims. Where an exception applies to part of the data, delete the rest.

Can you charge for a data subject request?

Normally no. Under Article 12(5) requests are free, but you can charge a reasonable fee or refuse where a request is manifestly unfounded or excessive. Under Article 15(3) you can charge a reasonable fee based on administrative costs for further copies of the same data.

Do data subject rights apply to employees?

Yes. Employees, job applicants and contractors are data subjects. Employee access requests are often the most complex because they involve emails mentioning colleagues, so redaction under Article 15(4) matters. The same applies under POPIA.

What is the difference between a DSAR and a data subject request?

A DSAR (data subject access request) is one type of data subject request: a request under the right of access. "Data subject request" or "DSR" covers all the rights on this page, including erasure, rectification and objection.

Run every rights request from one place

Data subject rights are where privacy compliance becomes visible to customers: a missed deadline or a half-completed deletion is the kind of thing people complain to regulators about. Core GRC's privacy rights module gives you one intake and log for requests across jurisdictions, helps track deadlines, and connects each request to your data map and vendor records so you know where to look and who to instruct. You can also set up a privacy request form to capture requests in a consistent format from day one.

Cover photo by Zulfugar Karimov on Unsplash