The GDPR Data Subject Rights, Explained

GDPR gives people a set of rights over their personal data, and honoring them is one of the most visible parts of compliance, because the requests come straight from your users. Here is each right in plain terms, and what it means operationally.

The Rights

• Access. People can ask what data you hold about them, and receive a copy along with context: why you hold it, and who you share it with. This is the request most people call a DSAR.
• Rectification. People can have inaccurate or incomplete data corrected.
• Erasure ("right to be forgotten"). People can ask you to delete their data, subject to exceptions such as legal retention obligations.
• Restriction. People can ask you to pause processing of their data in certain situations, for example while a dispute over accuracy is resolved.
• Portability. People can receive their data in a structured, machine-readable format, and have it moved to another provider where feasible.
• Objection. People can object to certain processing, notably direct marketing, which you must then stop.
• Rights around automated decisions. People have protections against decisions based solely on automated processing that significantly affect them, including profiling.

What They Have in Common

Every one of these rights depends on the same underlying capability: being able to find a specific person's data across your systems. You cannot provide, correct, delete, or export data you cannot locate. That is why a rights program is really a data-mapping program with a workflow on top.

For how to handle these requests end to end, see the DSAR guides.

How Concord Fits

Concord Privacy handles the full set as one configurable workflow, intake, identity verification, and routing to the systems that hold the data, so access, correction, and deletion are variations on the same process rather than separate builds.