All data subjects have specified rights with respect to the use of their personal data held by a controller or processor. These rights are:
- The right to be informed – individuals should be clear about what, why and in what way personal data will be processed, usually provided by privacy statements
- The right of access – individuals have the right to learn what data is held on then, by whom and why
- The right to rectification – individuals can request that personal data is corrected
- The right of erasure – individuals can request that all personal data is erased
- The right to restrict processing – individualscan ask organisations to stop processing their personal data
- The right to data portability – individuals can ask for their data in a machine readable format or to have it sent to another organisation
- The right to object – individuals can object to organisations processing their personal data
- Automated decision making and profiling – data subjects can ask for automated decision making to be reviewed by a human.
In most cases you only have 30 days in which to respond to these rights, so any request should be escalated to the responsible person in your organisation swiftly.
It should be noted that whilst a data subject has these rights, there are circumstances where your organisation may not enforce them. All data subject requests should be assessed on their own merits.
How can ProvePrivacy Help?
ProvePrivacy allows users to log data subjects requests of all typres directly into the system. Once logged ProvePrivacy alerts the correct team who can then manage the incident through to a successful conclusion, this includes logging each of the communications with the data subject and noting relevant exemptions.
