The 8 GDPR Data Subject Rights and How to Operationalise Them

Eight Rights Clusters

1. Transparent information (Arts 12–14) — privacy notices at collection and when data comes from another source
2. Access / DSAR (Art 15) — see the DSAR template guide
3. Rectification (Art 16)
4. Erasure (“right to be forgotten”) (Art 17) — with listed exceptions
5. Restriction (Art 18)
6. Notification of rectification/erasure/restriction (Art 19) to recipients where feasible
7. Portability (Art 20) — for consent/contract processing by automated means
8. Objection (Art 21) and automated decision-making / profiling (Art 22)

Timelines (Article 12(3))

Provide information on action taken without undue delay and in any event within one month of receipt. That period may be extended by two further months where necessary, considering complexity or number of requests — inform the data subject of any extension within the first month.

How CyberSilo Helps

• CSA tracks rights requests, owners, and deadlines
• ThreatHawk access logs support Art 15 fulfilment and auditability
• Playbooks for erasure vs retention conflicts (legal holds)

Frequently Asked Questions

How many GDPR data subject rights are there?

Chapter III (Arts 12–22) is commonly summarised as eight rights clusters, including access, erasure, portability, and objection.

How long do I have to respond?

Without undue delay and within one month under Article 12(3), extendable by two months for complex or numerous requests with notice to the data subject.

Does erasure always apply?

No. Article 17 lists exceptions, including legal obligations and establishment/exercise/defence of legal claims.

Related GDPR Resources

GDPR hub · DSAR · Retention · Fines · CSA