General Data Protection Regulation or GDPR gives every European Union citizen the rights on their personal data that they share with any organisation. GDPR is like our data protection bodyguard. They impose strict principles on any business and organisation that collect and process personal data. GDPR’s main target is to ensure data security and give every individual all possible rights to their personal data. Now comes the question, do you know how many individual rights are set out in the GDPR?

The GDPR sets out 8 individual rights. In this blog, we will address GDPR and know in detail how many individual rights are set out in the GDPR.

What is GDPR?

In 2021, General Data Protection Regulation (GDPR) is the toughest data security law of the European Union. It is laws and rules that give a guideline for collecting and processing personal data. Any businesses, organisations, websites, or similar institutions collecting personal data for any given purpose or benefit of their organisation must follow these rules. 

Moreover, it doesn’t matter wherever the organisation is in the world. As long as they’re processing and collecting data from EU citizens, they must follow the GDPR law and guidelines. The GDPR is effective from May 25, 2018. Whenever any data breach occurs due to negligence of GDPR law, the GDPR has strict penalties for violation of privacy and security standard. The penalties can reach up to tens of millions of euros.

The world has digitalised. New technologies are coming every day and we continuously share our personal data with businesses and organisations. We share our personal information whenever we are ordering food online, renting a car, in banks and hospitals, and so on. Unfortunately, the more we share, the more our data is exposed to data violations, for which many crimes have occurred in the past. 

The GDPR takes strong action against personal data breaches and puts strict rules and laws on data processors and controllers. It is to minimise crimes occurring through inadequate security of collected personal data. Hence, GDPR made Seven principles that every organisation must follow if they are processing personal data. They also give every citizen of the EU eight data subject rights. Our main concentration today, therefore, will be on how many individual rights are set out in the GDPR.

Key Definitions in GDPR

GDPR defines personal data and terms and roles connected to personal data: 

• Personal Data: Any piece of personal information that relates to identifiable or identified natural persons. For example, address, phone number, account data, number plate, credit card number, appearance, or any data that directly or indirectly help to identify a person.

• Data subject: The person who owns personal data.

• Data controller: The person or organisation determines what personal data to collect and where and how to use them.

• Data processors: The person or organisation processing personal data for the controller.

How Many Individual Rights Are Set Out in the GDPR?

Though GDPR’s main concentration is in imposing and regulating organisations that are handling personal information. But their main concern is protecting people from data breaches and crime happening due to data violations. 

Furthermore, as a data controller or processor of an organisation, you need to follow all the principles of GDPR law. Not only that, but you also give an individual the rights they have on their personal data. Moreover, as an EU citizen, you have the freedom to take advantage of the individual rights set out by the GDPR. 

Therefore, we have come to the point where we get familiar with how many individual rights are set out in the GDPR. According to the Information Commissioner’s Office (ICO, the UK GDPR provides the following 8 rights for individuals:

Our next step to how many individual rights are set out in the GDPR is to look at the 8 individual rights closely. 

1. The Right to be Informed

This is the first of how many individual rights are set out in the GDPR. According to the right to be informed, every individual needs to know if their data is collected or processed and the reason behind it. Therefore, organisations have to maintain complete transparency while collecting data. 

Firstly, they have to give data subject privacy information of the organisation before they collect the data. Secondly, the organisation has to share its privacy policy so that it is brief, transparent, intelligible, and easily accessible. Also, it must use clear and plain language.

Organisations have to provide the following privacy information to collect individual data:

1. Business or organisation identity
2. Purposes for processing their personal data.
3. How long the organisation will retain the data.
4. With whom the organisation will share the data. In case of international transfer, the details of it.
5. The rights they have on their personal data.
6. The right to complain.

Moreover, if the organisation collects personal data from another source, they must give the same privacy information within a certain period after obtaining it to the data subject. Plus, it must not be any more than one month.

Organisations can regularly review and update their privacy policy and maintain maximum transparency with data subjects. Furthermore, if an organisation makes any changes to their privacy policy or uses the collected data for any new reason, they must inform the data subject. 

Following the right to be informed helps organisations to comply with GDPR rules. It also helps to achieve people’s trust. But ignoring it can leave organisations with penalties and lead to reputation damage.

2. The Right of Access

According to the second individual right of GDPR, every person or the data subject has the right to access the data an organisation hold on them. They will receive a copy of their personal information or any other information upon request. The request is known as a subject access request (SAR). 

A person can make SAR in written or verbal form and even through social media. Once the person makes the request, organisations have to check the validity of the request and who is asking for it. Apart from the data subject, any third party like a relative, friend, or solicitor can also make the SAR on behalf of the data subject. But the third party has to provide evidence of their relation to the subject.

In most cases, SAR is free, but it may vary depending on the complexity of the process of data access and the number of access requests a person makes. If an organisation receive a valid SAR from the data subject, here are the things they must do:

1. Perform a proper search for the information request.
2. Need to respond without delay, and that is within a month of receiving the request.
3. In certain circumstances, organisations can extend the time up to two months. 
4. The organisation has to provide the information in an accessible, concise, and intelligible format.
5. Lastly, they have to disclose the data maintaining security.

An organisation can refuse to give the information in case of some exemption or restriction. Also, they can refuse if the request refers to unfound or excessive data. 

3. The Right to Rectification

In how many individual rights are set out in the GDPR, the third right is about data rectification. Individuals have the right to rectify inaccurate information. They also have the right to complete or add information if there is something incomplete or missing. 

Similar to SAR, a person can request for rectification in written, verbal or electronic form. An organisation has to respond to the request in the lowest possible time and within one month at best. Just like subject access requests, an organisation may refuse to request rectification. 

Furthermore, an organisation must keep the personal information up to date and complete and also ensure that the data are accurate. They need to do so with or without any rectification request being made.

4. The Right to Erasure

The fourth individual right of GDPR is that a person has the right to erase the data an organisation has on them or ask the organisation to omit them. But it is not absolute to erase the data in special circumstances like some legal or criminal reasons. Much like the other two requests, erase requests can be written, verbal, or through electronic means.

An organisation has a maximum of one month to process the erase request and can extend in case of complexity. If any exemption applies, an organisation can refuse to comply with an erasure request.

Here are the reasons why an individual has the right to erase data that an organisation obtains:

1. The data is no more compulsory for the purpose for which it was initially taken.
2. If the organisation is waiting for subject data consent to process the data and the data subject doesn’t give or withdraw the consent.
3. An individual may object or deny processing the data for the given purpose.
4. If the organisation is taking the data for direct marketing purposes and the data subject objects to processing the data.
5. When an organisation unlawfully process personal data.
6. Organisations have to comply with legal obligations.

5. The Right to Restrict Processing

A person has the right to restrict or suppress the processing of their personal data by an organisation. Though this right can be overridden in some circumstances, people can ask for it. When a person requests a restriction on the processing of their personal data, an organisation may store the data but cannot use it. One can request a restriction in written or verbal form, and the organisation has to respond within a month.

A person can ask organisations to restrict the processing of their personal data in the following circumstances:

1. If they think the data is not accurate and the organisation needs to verify the accuracy of the data
2. If the data processing is unlawful, but the person doesn’t want to erase the data.
3. When the organisation no longer needs the data, but the data subject needs it as a legal claim or evidence.
4. If an organisation is taking steps to verify the overriding grounds in the context of a request.

If a person requested you to rectify, erase or restrict processing their data, an organisation must inform any third party with whom they are sharing the data that the data subject has exercised those rights.

6. The Right to Data Portability

The right to data portability in GDPR gives everyone the option to obtain and reuse their personal data, which they gave to a data controller in structured, commonly used, and machine-readable format. Under this right, an individual can request the controller to transfer their data directly to another data controller.

This right can take place:

1. If organisations have a lawful basis for processing this information 
2. If the organisation is carrying out the processing by automated means 

7. The Right to Object

Under the GDPR law, a person has the right to object to the collection and processing of their data. Here an individual has the complete right to stop their data from being used for direct marketing. 

A person also has the right to object if the processing is for:

• A purpose carried out in the public interest
• The exercise of official authority entrusted on the organisation
• The organisation’s legitimate interests (or those of a third party)

In circumstances like these, the objection is not absolute, but a person can justify the objection through verbal or written means. In some cases, an organisation may continue processing if they can show that they have a good reason for doing so.

8. Rights in Relation to Automated Decision-Making and Profiling

The last right under GDPR law gives everyone the right to automated decision-making and profiling. It depends on:

1. Any automated individual decision-making like making a decision solely by automated means without any human involvement
2. Profiling or automatic processing of personal data to find out certain things about an individual

A data subject needs to give their consent in either case before an organisation uses the data for automated decision-making and profiling.

Conclusion

To answer the question of how many individual rights are set out in the GDPR, we have come across 8 individual rights. In order to know more information, like how many individual rights are set out in the GDPR, you can join our course on GDPR.