/rights-check

description: Verify data subject rights implementation (access, erasure, portability, etc.)

Data Subject Rights Check

Evaluates implementation of the 8 data subject rights under GDPR Articles 12-22.

Arguments

• `$1` - Specific right to check (optional: access, rectification, erasure, restriction, portability, object, automated-decisions, all)
• `$2` - Check depth (optional: basic, comprehensive, audit-ready)

Overview of Data Subject Rights

GDPR grants individuals 8 fundamental rights over their personal data. Organizations must facilitate the exercise of these rights.

General Requirements (Article 12)

Response Timeframes

• **1 month** to respond to requests (standard)
• **+2 months** extension if complex/numerous (inform data subject within 1 month)
• **Without undue delay** for rectification/erasure urgent cases

No Fee (Generally)

• Rights exercised **free of charge**
• Fee allowed if requests manifestly unfounded, excessive, or repetitive
• Reasonable fee for administrative costs

Transparent Communication

• **Concise, transparent, intelligible** language
• **Plain language** (no legalese)
• **Written or electronic** form (preference of data subject)
• **Oral** if requested (must verify identity)

Identity Verification

• Verify identity before responding (proportionate measures)
• Request additional information if reasonable doubts
• Balance verification with not collecting excessive data

Right to Complain

• Inform data subjects of right to lodge complaint with supervisory authority
• Provide supervisory authority contact details

1. Right to Be Informed

**Implicit right exercised through privacy notices**

Fair Processing Information (Articles 13-14)

**At Collection (Article 13)**:

• Controller identity and contact
• DPO contact (if applicable)
• Purposes and lawful basis
• Legitimate interests (if applicable)
• Recipients or categories
• Third country transfers and safeguards
• Retention period
• Data subject rights (access, rectification, erasure, etc.)
• Right to withdraw consent (if applicable)
• Right to complain
• Statutory/contractual requirement
• Automated decision-making details

**Not Obtained from Data Subject (Article 14)**:

• All Article 13 information, PLUS:
• Categories of personal data
• Source of data (including public sources)

**Timing**:

• At collection (Article 13): When data obtained
• Not from subject (Article 14): Within 1 month, or at first communication, or before disclosure

Implementation Check

• Privacy notices available and accessible?
• Content complete per Articles 13/14?
• Multi-layered approach (short + full notice)?
• Language clear and plain?
• Updated when processing changes?

2. Right of Access (Article 15)

**Data subjects can request**:

1. Confirmation whether personal data processed 2. Copy of personal data 3. Supplementary information

Supplementary Information Required

• Purposes of processing
• Categories of data
• Recipients or categories
• Retention period (or criteria)
• Rights (rectification, erasure, restriction, object, complain)
• Source of data (if not from data subject)
• Automated decision-making details
• Safeguards for third country transfers

Copy of Data

• **First copy**: Free of charge
• **Additional copies**: Reasonable fee for administrative costs
• **Format**: Commonly used electronic format (if electronic request)

Implementation Check

• Process to search and compile personal data?
• All systems/databases covered?
• Automated retrieval where possible?
• Verification of identity?
• Response within 1 month?
• Copy provided in accessible format?
• Supplementary information included?

Common Challenges

• Data scattered across multiple systems
• Unstructured data (emails, documents)
• Third-party data (processor, joint controller)
• Impact on others' rights (redaction needed)
• Manifestly unfounded/excessive requests

3. Right to Rectification (Article 16)

**Data subjects can request**:

• Correction of inaccurate personal data
• Completion of incomplete personal data

Scope

• Factual inaccuracies (names, addresses, dates)
• Incomplete data relevant to purposes
• Takes into account purposes of processing

Notification Obligation

• Communicate rectification to recipients
• Unless impossible or disproportionate effort
• Inform data subject of recipients if requested

Implementation Check

• Simple process to submit corrections?
• Verification of corrections?
• Updates propagated to all systems?
• Notification to recipients/processors?
• Response within 1 month?

4. Right to Erasure / "Right to be Forgotten" (Article 17)

**Data subjects can request deletion when**:

Grounds for Erasure

1. **No longer necessary**: Data not needed for original purpose 2. **Consent withdrawn**: Lawful basis was consent, now withdrawn 3. **Objection**: Data subject objects (no overriding legitimate grounds) 4. **Unlawful processing**: Processing violates GDPR 5. **Legal obligation**: Deletion required by EU/Member State law 6. **Children's data**: Consent obtained when subject was child (Article 8)

Exceptions (Right Not Absolute)

• **Freedom of expression/information**
• **Legal obligation** (compliance with law)
• **Public interest** (public health, archiving, scientific/historical research)
• **Legal claims** (establishment, exercise, defense)

"Right to be Forgotten" (Public Data)

• If data made public, controller must inform other controllers
• Take reasonable steps (technical measures) to notify
• Consider technology and cost

Implementation Check

• Process to identify and delete data?
• Deletion from all systems (including backups)?
• Notification to processors and recipients?
• "Right to be forgotten" for published data?
• Response within 1 month?
• Assessment of grounds and exceptions?

Deletion Challenges

• Backups (delete on backup cycle, mark for deletion)
• Legal hold (litigation, regulatory obliga