What individuals can ask for.
WHAT RIGHTS COMMONLY EXIST
To be informed Access to their data Correction of inaccuracies Deletion, in defined circumstances Restriction of processing Portability of data they provided Objection to certain processing Not to be subject to solely automated decisions with significant effect
WHAT ACCESS MEANS
A copy of their data, plus information about the processing.
WHAT IT DOES NOT MEAN
Every document mentioning them, without limit.
WHAT DELETION DOES NOT OVERRIDE
Legal retention obligations.
WHAT EXAMPLE LOOKS LIKE
Financial records you must keep for tax purposes.
WHAT TO DO THEN
Delete what you can, explain what you must keep and why.
WHAT PORTABILITY COVERS
Data the person provided, in a machine-readable format.
WHAT OBJECTION APPLIES TO
Processing based on legitimate interests, and direct marketing.
WHY MARKETING IS DIFFERENT
Objection to marketing is absolute; you must stop.
WHAT TIMEFRAMES APPLY
Those set by the applicable law, typically counted in days.
WHY TO KNOW YOURS PRECISELY
Missing them is a straightforward breach.
WHAT TO BUILD
A process, before a request arrives.
WHAT TO RECORD
Every request and how it was handled.
