> For the complete documentation index, see [llms.txt](https://doc.dastra.eu/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://doc.dastra.eu/en/gdpr/concepts/rights.md).
# Data subject rights (DSR)
Find out about the different rights introduced by the GDPR.
The GDPR reaffirms the rights of individuals, introduces **data portability** and strengthens the obligations of the **data controller**. Individuals must **retain control** of their data, and the controller must **clearly explain** how to exercise those rights.
* **Response time**: 1 month from receipt (extendable by **2 months** for complex or numerous requests; notify the extension within the first month).
* **Free of charge**: no fees, except for manifestly **unfounded** or **excessive** requests (in which case, justify the refusal or charge reasonable fees).
* **Traceability**: record requests and responses (proof of compliance).
***
## Two major obligations for the data controller
1. **Inform** data subjects (purposes, legal bases, retention periods, recipients, rights, transfers, DPO contact, etc.).
2. **Notify the execution** of operations in compliance with the exercise of rights (rectification, erasure, restriction) or **justify** a refusal.
***
## Common operational rules (all rights)
* **Deadline**: 1 month (up to +2 months if necessary, with notice within 1 month).
* **Identity verification** proportionate to the risk (avoid requesting more than necessary).
* **Intake channels**: dedicated email, online form, customer portal, postal mail.
* **Logging**: date of receipt, verified identity, scope, decision, closure date.
* **Exemptions / limits**: third-party rights, trade secrets, legal retention obligations, security, fraud prevention… (document).
***
## Right to information (Arts. 13 & 14)
To be provided **at the time of collection** (direct) or **within 1 month** (indirect): controller identity, purposes, legal bases, recipients, transfers, retention periods, rights, DPO contact, source (if indirect), automated decision-making/profiling where applicable.
> Support: form notices, privacy policy, cookie banner, signage (CCTV), call center scripts, etc.
***
## Right of access (Art. 15)
The individual may obtain:
* **confirmation** that data is being processed,
* **access** to the data and associated information (purposes, categories, recipients, retention periods…),
* a **copy** of the data (free for the first copy).
**Modalities**:
* **Written** (postal or email), **on-site** (if appropriate), or **online** (secure portal).
* Responses must be **understandable** (explanation of codes, acronyms, scores).
**Limits / refusal**: abusive requests, impact on third-party rights, no data held → respond regardless to confirm.
***
## Right to rectification (Art. 16)
Correct without delay **inaccurate data** and complete **incomplete data** (via supplementary statement). Inform recipients of the rectifications where applicable.
***
## Right to erasure (Art. 17)
Erase data when:
* it is no longer necessary,
* consent is withdrawn,
* a founded objection is raised and there is no compelling legitimate ground,
* processing is unlawful,
* there is a legal obligation to erase,
* data was collected from children (information society services).
**Exceptions**: legal retention obligation, exercise/defense of rights in legal proceedings, public interest (health, research), freedom of expression and information. Inform recipients where applicable.
***
## Right to restriction (Art. 18)
Temporarily suspend processing (except storage) if:
* accuracy is contested,
* processing is unlawful (the individual requests restriction rather than erasure),
* data is needed for **the exercise/defense of rights**,
* an objection is pending verification.
***
## Right to object (Art. 21)
The individual may object:
* **at any time** to direct marketing (including related profiling) → **obligation to cease** without delay;
* for reasons specific to their situation, to processing based on **legitimate interests** → accept unless there are compelling legitimate grounds.
> Provide **simple opt-out mechanisms** (unsubscribe link in emails, account preference, checkbox…).
***
## Right to data portability (Art. 20)
* Receive **data provided** to the controller in a **structured, commonly used and machine-readable format**,
* and **transmit it to another controller** (where technically feasible). Applies when processing is based on **consent** or **contract** and carried out by **automated means**.
***
## Automated individual decision-making & profiling (Art. 22)
Right **not to be subject** to a decision based **solely on automated processing** that produces **legal effects** or similarly significant effects (exceptions: contract necessity, legal authorization, explicit consent, with **safeguards**). Obligations: **clear information**, **human intervention**, **ability to contest** and express a view.
***
## Consent (Arts. 6, 7)
Consent must be **freely given, specific, informed and unambiguous** (positive action, **not pre-ticked**). Withdrawal must be **as easy as giving** consent. Examples: sensitive data, electronic prospecting, cookies (depending on purposes).
***
## Operational playbook (template)
### Intake channels
* Web form (authenticated if possible), dedicated email (privacy@…), customer portal, postal mail.
### Identity verification
* Proportionate (confirmation email, one-time code, ID document if genuine risk).
* Avoid increasing the risk (do not request more than necessary).
### SLA & workflow
1. **Acknowledgement of receipt** promptly (for example within 72 hours, an internal target: the GDPR sets no deadline for this step) with case number and target deadline,
2. **Qualification** of the right requested and scope (systems, subsidiaries, processors),
3. **Collection** and internal review (business/IT/legal/DPO),
4. **Response** within 1 month (+ notification if extended),
5. **Proof**: file documents and decision, notify relevant recipients (rectification/erasure/restriction).
### Evidence to retain
* Request, verified identity, searches conducted, reasoned decision, date of sending, notification logs, data transmitted to the individual.
***
## Managing rights in Dastra
* Create a request in the **Requests** module, assign it and track its progress in the workflow. By default, the steps are: New, Admissibility check, In progress, Communication to requester, Closed. You can customize them.
* Record the verified identities, the searches and the decisions. Store the supporting documents in the **Request files** section of the request.
* Use response templates, collection forms and the conversion of incoming emails into requests. Dastra flags overdue requests.
* Follow the indicators of the **Reporting** page: closing time, volumes, closed reasons, requests per operator.
The steps of managing a data subject request
***
## Response templates
Three short templates to adapt:
* **Acknowledgement of receipt**:\
"We received your request on \[date]. It concerns the right to \_\_\_\_\_\_. We will reply no later than \[date]."
* **Extension**:\
"Given the complexity or the number of requests, the deadline is extended by two months. You will receive a reply no later than \[date]."
* **Reasoned refusal**:\
"Your request cannot be granted because \_\_\_\_\_\_ (GDPR ground). You may lodge a complaint with the competent supervisory authority or seek a judicial remedy."
***
## Key takeaways
* Deadline **1 month** (up to +2), **free of charge** except for abuse, **traceability** is mandatory.
* Implement **standardized processes and evidence trails**.
* Provide **simple** opt-out and portability mechanisms.
* Centralize request management in **Dastra** to secure, prove and monitor compliance.
***
## For more information
{% content-ref url="/pages/-M31ydu73LeeHMZQ4ECM" %}
[Data subject right request](/en/features/requests.md)
{% endcontent-ref %}
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://doc.dastra.eu/en/gdpr/concepts/rights.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
