GDPR Basics for Individuals: Your Data Rights Explained
Understand your rights under GDPR and similar privacy regulations. Learn how to exercise data access requests, request deletion, and identify when companies violate your privacy rights.
Key Takeaways
- The General Data Protection Regulation grants EU residents (and increasingly, citizens worldwide through similar laws) eight fundamental data rights:
- Send an email to the company's Data Protection Officer (check their privacy policy for the contact address) stating: your full name, any identifiers they might use (account ID, email), and that you are making a Subject Access Request under GDPR Article 15.
- If a company ignores your request or provides an inadequate response, file a complaint with your national data protection authority.
- Similar regulations now exist worldwide: CCPA/CPRA in California, LGPD in Brazil, PIPA in South Korea, and PIPL in China.
- Right to be informed — Companies must explain what data they collect 2.
Your Eight Core Rights
The General Data Protection Regulation grants EU residents (and increasingly, citizens worldwide through similar laws) eight fundamental data rights:
- Right to be informed — Companies must explain what data they collect
- Right of access — You can request a copy of all data held about you
- Right to rectification — Correct inaccurate personal data
- Right to erasure — Request deletion of your data (right to be forgotten)
- Right to restrict processing — Limit how your data is used
- Right to data portability — Receive your data in a machine-readable format
- Right to object — Opt out of direct marketing and profiling
- Rights related to automated decisions — Challenge algorithmic decisions
Filing a Data Access Request
Send an email to the company's Data Protection Officer (check their privacy policy for the contact address) stating: your full name, any identifiers they might use (account ID, email), and that you are making a Subject Access Request under GDPR Article 15. They must respond within 30 days, free of charge.
When Companies Do Not Comply
If a company ignores your request or provides an inadequate response, file a complaint with your national data protection authority. In the EU, each country has a supervisory authority. GDPR fines can reach 4% of global annual revenue, so companies take complaints seriously.
Beyond GDPR
Similar regulations now exist worldwide: CCPA/CPRA in California, LGPD in Brazil, PIPA in South Korea, and PIPL in China. While specifics differ, the trend toward individual data rights is accelerating globally.