Individual Rights Under the GDPR

Last updated: 20 August 2026

The EU’s General Data Protection Regulation (GDPR) gives individuals (“data subjects”) a set of rights over their personal data. These rights are subject to conditions and exceptions under the Regulation.

The rights

Right to be informed — to receive clear information about how personal data is collected and used.
Right of access — to obtain confirmation that data is being processed, a copy of the data, and information about the processing.
Right to rectification — to have inaccurate personal data corrected, and incomplete data completed.
Right to erasure (the “right to be forgotten”) — to have personal data deleted in certain circumstances.
Right to restriction of processing — to limit how personal data is used in certain circumstances.
Right to data portability — to receive personal data in a structured, commonly used, machine-readable format, and to have it transmitted to another controller where feasible.
Right to object — to object to certain processing, including direct marketing.
Rights related to automated decision-making and profiling — not to be subject, in certain circumstances, to a decision based solely on automated processing that produces legal or similarly significant effects.

Organisations within the scope of the GDPR need processes to recognise these requests and to respond within the time limits the Regulation sets.