Glossary term
Data Subject Rights
Subject: Technology, Cyber and Data, Data Protection and Privacy
Also known as: Data principal rights, Individual rights
Data subject rights are the powers privacy laws give individuals over their own personal data, such as seeing it, correcting it, having it erased, moving it elsewhere, or objecting to certain uses.
Explanation
Under the GDPR the list includes access, rectification, erasure, restriction, portability, objection, and protection from solely automated decisions. India's DPDP Act gives similar rights to a data principal. A data subject access request (DSAR) is the usual way to exercise the right of access: the person asks for a copy of their data and details of its use. Data portability lets people receive data they supplied in a common machine-readable format and have it sent to another provider. Organisations must verify the requester's identity, answer within a set period, often one month, and may refuse only on listed grounds. Handling requests needs searchable systems, since data sits in many places. Slow or missing replies are a common trigger for complaints to regulators.
Example
A former customer of a telecom firm sends an access request. The privacy team confirms her identity, searches billing, call-centre and marketing systems, removes information about other people, and sends a clear copy within the deadline. She then asks the firm to delete her marketing profile, which it does while keeping invoices required by tax law.
Not to be confused with
- Right to Erasure (Right to be Forgotten)
- One specific right within the group, the right to have data deleted. Data subject rights covers the whole set.