A customer can email your support inbox to ask for all the data you have gathered about them. They may also request permanent deletion of their account or ask for an explanation of why an algorithm rejected their loan application. No matter how they phrase the request, these people are exercising their legal rights. The clock for your response starts the moment you receive the message.
Articles 12 to 22 of the GDPR set out eight legal protections for individuals. These rights let people ask an organisation for the personal data it holds on them, request corrections or deletions, and contest decisions made by algorithms. Organisations typically have one month to deliver a complete response to such requests.
Those rights are safeguarded under the GDPR and, after Brexit, also under the UK GDPR. There are eight of them, outlined in Articles 12 to 22 of the regulation. Any organisation that stores personal data on someone in the EU or UK must be capable of answering these requests accurately within one month. At Shipshape Data we build data foundations for AI, and one of the first checks we perform when evaluating a client's architecture is whether they can locate, provide, correct, or delete a single person's data on demand. Otherwise, satisfying such a request might now need three engineers and a week of searching.
This article outlines the eight rights and how they work in practice. It details the steps you must follow when you receive a request and the particular circumstances that allow you to refuse one. The guide is intended for anyone tasked with handling these requests.
In most organisations this falls to an engineer, a support lead, or the person who drew the short straw, and rarely to the legal team.
The purpose of these rights
The General Data Protection Regulation became effective across the EU in May 2018. After Brexit it was incorporated into UK law as the UK GDPR, with only minor changes. Both versions rely on the same principle: personal data legally belongs to the individual it describes, not to the entity that stores it. Collecting someone's email address does not give you the right to use it however you wish.
Articles 12 to 22 create eight enforceable rights based on that principle. Any person can invoke these rights by contacting an organisation. The process does not require a lawyer and is generally free of charge. The organisation must give a full response or an explanation for any delay within one month.
GDPR treats your data as being under your control, not as property of a company simply because it has been collected.
The individuals covered by these rights
Anyone whose personal data an organisation processes is a data subject. This category includes customers, employees, newsletter subscribers, website visitors, and job applicants, even those who were not hired. A person's nationality does not change their status as a data subject. Applicability depends on whether the data processing occurs in the EU or UK, or whether the organisation offers goods or services to someone in those regions. Children enjoy the same rights as adults, usually exercised by a parent or guardian on their behalf. The only clear exception is a deceased person; GDPR no longer applies after death, although other laws may still regulate their data.
Personal data is defined broadly for purpose: anything that identifies you, or could identify you when combined with other information. Name, email, phone number, obviously. Also IP addresses, device identifiers, location history, an online username, a photo showing your face. Many organisations assume that removing a name is sufficient to escape GDPR. That assumption is usually wrong: if there is a reasonable way to re-link the record to a person, the protection still applies.
The eight rights, listed individually
Eight rights naturally group into four pairs: telling you and showing you, fixing and removing, pausing and moving, refusing and appealing.
Being told, and seeing what's held
The right to be informed obliges an organisation to tell you what data it collects, why it collects it, who receives it, and how long it will retain it. This information must appear in a privacy notice written in clear language rather than in complex legal jargon. All other rights rely on this requirement. You cannot ask to correct or delete data if you do not know the organisation holds it.
The right of access is also called a subject access request or SAR. It permits an individual to request a complete copy of the personal data an organisation keeps about them. The organisation must also explain how it processes this data. This service is usually free of charge and the information must be supplied in a usable format. A SAR often reveals more detail than the requester expects, such as the data sources and the parties with whom it was shared.
Fixing what's wrong, removing what shouldn't be there
The right to rectification covers correcting inaccurate data or completing incomplete records, and organisations must act without undue delay once the error is shown. This is most important when a wrong figure or flag is quietly influencing a decision: a credit score, a job application, an insurance premium.
The right to erasure, also known as the "right to be forgotten," requires organisations to delete data in specific situations. These include cases where the data is no longer needed for its original purpose, the individual has withdrawn consent, or the individual has objected to processing and there is no overriding legitimate reason to continue. Deletion is also required if the data was collected unlawfully. This right is not absolute. If an organisation is legally required to retain information, such as tax records, the right to erasure does not override that duty.
Pausing processing, moving your data elsewhere
The right to restrict processing offers an alternative to continuing as usual or deleting data entirely. A person may invoke this right if they dispute the accuracy of their data. They may also use it if the processing is unlawful but they prefer to freeze the information rather than have it erased. Additionally, individuals can request restriction if they need the data for a legal claim, even if the organisation no longer needs it.
The right to data portability lets individuals obtain data they gave to one organisation and transfer it to another in a structured, machine-readable format. This right applies only when the data processing is based on consent or a contract and is carried out through automated systems. In practice, it is most useful for moving between banks, cloud storage providers, or other services where a person has accumulated years of personal activity and wants to switch to a different provider.
Objecting, and challenging a machine's decision
The right to object stops data processing immediately in specific situations, particularly regarding direct marketing. Organisations have no way to override this; they must honour every objection to marketing. When processing is based on research or legitimate interests, the organisation must demonstrate compelling grounds that outweigh the individual's interests to continue.
The final right involves automated decision-making and profiling. You have the right to avoid decisions made solely by an algorithm if those decisions have legal or similarly significant effects. Examples include credit refusals, automated dismissals, or the rejection of benefits. In these cases, you must have the opportunity to request a human review, provide your perspective, and challenge the result.
Why this gets harder once AI is in the stack
The eight rights were not created for machine learning. A deletion request is simple when it applies to a customer record in one table. The process is less clear after that record has been used in a training set. This is because "delete the data" and "delete its influence on a model" are different operations. Most organisations do not have a clear method for the second task.
The right to object to automated decision-making faces a similar obstacle. It is possible to explain decisions produced by a rules engine that has been well-documented. However, explaining a decision made by a large model containing millions of parameters remains an unsolved technical problem. Regulators will soon stop accepting "the model said no" as a complete explanation.
We frequently observe a specific pattern in our work with clients. Organisations often implement AI quickly and only recognise gaps in data subject rights when a request is filed against a system that uses AI. This leads to a disorganised response instead of a planned design choice. It is more cost-effective to organise data lineage and retention policies before an AI system is launched than to attempt to add them later when regulators or customers make enquiries. If your data governance function is unable to track an individual's data through all systems, including those involving AI, you should address this deficiency before it is identified during an audit.
Managing a request you receive
These obligations are mandatory. There is no grace period because "we're a small team." The time limit begins as soon as a request arrives. This applies regardless of the method used, such as email, a web form, or a social media post if that is how your organisation typically communicates with customers.
The one-month deadline
Organisations must respond within one calendar month. This period begins on the day the request is received, regardless of when it is read. The deadline can be extended by up to two additional months if the requests are complex or numerous. If an extension is necessary, the organisation must notify the requester within the first month and provide a reason. Organisations may ask for identification to verify a person's identity. This is the only action that can pause the response timer, provided the original request lacked sufficient information to identify the individual. Identification checks must not be used as a method to delay the process.
The components of a correct response
When an organisation receives an access request, it must provide all relevant information. This includes the data itself, the purpose of its collection, the identities of any recipients, the retention period, and the source of the data if it was not obtained directly from the individual. Providing only selective extracts is insufficient unless the individual specifically limited their request to a certain type of processing. The response must also describe the individual's other legal rights and provide instructions on how to file a complaint with the Information Commissioner's Office or the relevant regulatory body in other jurisdictions.
Format is more important than it may seem. Use plain language instead of legal terminology. Provide data in a structured and common format like PDF or CSV rather than a proprietary one. For portability requests, the data must be machine-readable. Use formats such as JSON or XML so the next provider can import the information directly without manual entry.
Verification and cost
It is reasonable to request additional information to verify an identity, especially when sensitive data is involved, but the request must be proportionate. Requiring a passport, a utility bill, and a signed statement for a standard request is not proportionate; this acts as an obstruction rather than a necessary precaution. Charging a fee is only allowed in specific circumstances, such as when a request is clearly unfounded, excessive, or repeated too frequently. In these cases, the fee must represent the actual administrative cost and cannot be used to discourage people from making requests.
When you can say no, or at least not yet
None of these rights are unconditional. GDPR builds in specific, named grounds for refusing, delaying, or narrowing a response, and the exemptions exist to balance individual privacy against other things that also matter: other people's rights, legal duties, the public interest.
Organisations may refuse requests that are clearly groundless or excessive. The organisation must demonstrate why a request meets these criteria rather than just stating that the work is difficult. Legal requirements to store data take priority over requests for erasure. For example, a company cannot delete records it must keep for a specific time, such as tax filings or employment documents. Data required to establish, exercise, or defend a legal claim can be retained until the matter is resolved.
Specific types of data processing receive broader exceptions. National security and law enforcement agencies may limit access rights if providing the information would interfere with their operations. Journalism, academic research, and artistic or literary expression are protected by freedom of expression rules, which are balanced against privacy interests on a case-by-case basis. Medical researchers may refuse a request to delete data if doing so would significantly damage the research. These are not general exemptions from all obligations. Each applies only to a particular right in a specific situation. Organisations that cite a research exemption for every request usually fail to justify their claims when audited by regulators.
How this works in practice
A rejected loan application is a common reason for an access request. When an applicant asks to see the data used to make the decision, they may find that a database error merged their record with another person. This usually happens because the individuals share the same surname and postcode. These types of identity errors occur more frequently than most organisations acknowledge.
A former employer's records may state that an employee was fired for misconduct when that person actually resigned. This situation requires a rectification. Correcting such an error is important because an inaccurate entry can negatively affect a person's professional references for a long time.
A person closes a social media account and later finds that the platform retained all posts, messages, and photos. If the company processed that data based on consent and the user withdrew that consent, the company must erase the data unless another legal basis exists. This is a clear requirement in theory. In practice, these requests often show that a company does not have a clear understanding of where its data is stored.
If you continue to receive marketing emails after unsubscribing several times, you have a clear right to object. There are no exceptions for direct marketing. The sender must honour your request immediately. Repeated failures to stop these emails are a frequent cause of complaints to the ICO.
Data portability allows you to switch banks without manually entering years of transaction history. You can request your data in a structured format and provide it to the new bank to complete the process.
You are not required to start your financial history at the outset.
Building this into the architecture, not bolting it on
Effective organisations handling these requests share a single trait: they pinpoint where personal data resides prior to a request. They avoid depending on the notion that "we could find out with enough time," and instead keep a precise map connecting each system, pipeline, and model to the particular individuals whose data is processed. Other organisations become aware of disorganisation in their data systems only when a regulatory deadline is already looming.
Shipshape Data searches for this particular gap while assessing a client's customer data architecture. The success of a request-handling process relies on the data quality and lineage that underpin it. When personal data is spread across disconnected systems, process documentation cannot guarantee a full response within thirty days. You ought to fix the architecture first to keep requests from turning into emergencies.
This principle becomes even stronger when AI is involved. A model built on personal data must have a method to trace, and if needed unwind, that influence when a training set contains data that someone later requests to delete. Creating that traceability from the beginning, instead of attempting to rebuild it after a regulator requests it, separates a manageable compliance function from a permanent liability under your AI programme.
If you need a clear answer about the location of your own gaps, that assessment is our service. Talk to us and we will directly inform you whether your data foundation can produce, correct, or delete an individual's record on demand, and what is required to achieve that if it cannot yet.
Theory represents the initial step. If you wish to apply these methods to your own data, our data consultancy will assist you in progressing from the initial concept to a production environment.
Frequently asked questions
What is GDPR?
GDPR stands for the General Data Protection Regulation, the EU legislation that regards personal data as something an individual controls rather than something a company owns merely because it collected it. The article describes it via eight specific rights, listed in Articles 12 to 22, which anyone can invoke directly with an organisation.
What does GDPR stand for?
GDPR means the General Data Protection Regulation. The article notes that it became effective across the EU in May 2018 and was incorporated into UK law as UK GDPR after Brexit with minimal changes, granting individuals the same eight rights in both instances.
What is GDPR in the UK?
UK GDPR is the version of the regulation enacted in domestic law after Brexit, remaining largely unchanged from the EU original. The article indicates it applies to anyone whose data is processed in the UK, or who is offered goods or services there, irrespective of nationality.
What are the 8 rights of individuals under GDPR?
The article groups the eight rights into four categories. These are the right to be informed and to view held data, the right to have data corrected or deleted, the right to restrict or transfer processing, and the right to object to or contest an automated decision. Each right is governed by specific conditions and none apply in every circumstance.
How many GDPR rights are there?
Articles 12 to 22 of the regulation enumerate eight specific rights. These consist of the right to be informed, the right of access, the right to rectification, the right to erasure, and the right to restrict processing. They also comprise the right to data portability, the right to object, and rights concerning automated decision-making.