Eight rights, none absolute, all sharing one set of mechanics. Organisations tend to build a process for access and improvise the rest, which is where the failures come from.
The shared mechanics
Everything below runs on the same rules: respond without undue delay and within one month; extend by two further months for complex or numerous requests only if you tell the person inside the first month; act free of charge unless the request is manifestly unfounded or excessive; and when refusing, explain why and give the right to complain to the supervisory authority and to a judicial remedy.
There is no prescribed form. A request made in passing, to the wrong department, without citing an article, still counts. Training front-line staff to recognise one matters more than any policy document.
The eight
| Right | What it obliges | Qualified by |
|---|---|---|
| Information (Arts 13-14) | Tell people at collection what you do and why | Limited exceptions where they already know, or it is impossible |
| Access (Art 15) | A copy of their data plus supplementary information | Third-party data, privilege, other exemptions |
| Rectification (Art 16) | Correct inaccurate data, complete incomplete data | Whether the data is actually inaccurate |
| Erasure (Art 17) | Delete, in defined circumstances | Legal obligations, claims, freedom of expression, public interest |
| Restriction (Art 18) | Pause processing while something is resolved | Available only in defined situations |
| Portability (Art 20) | Provide data in a structured, machine-readable form | Only consent/contract bases, only automated processing |
| Objection (Art 21) | Stop, unless you show compelling grounds | Absolute for direct marketing; balanced otherwise |
| Automated decisions (Art 22) | Not be subject to solely automated significant decisions | Contract, law, or explicit consent: with safeguards |
Two are narrower than people expect. Portability does not apply to data you inferred or observed under legitimate interestsLegitimate interestsA lawful basis needing a three-part test: a legitimate purpose, necessity, and a balance against the individual's interests and rights.: it is limited to data the person provided, processed automatically, on consent or contract. Erasure is not a right to be forgotten on demand; it applies in listed circumstances and yields to legal retention duties.
One is stronger than people expect. Objection to direct marketing is absolute. There is no balancing, no assessment, no “compelling grounds” argument. You stop.
The interactions that catch people out
Access then rectification. The standard sequence: a subject access requestSubject access requestPractitioner shorthand for exercising the right of access. Not a statutory phrase, and no particular form or wording is required to make one. surfaces something wrong, which becomes a rectification request. Treat the second as a fresh request with its own clock, not as a continuation of the first.
Rectification then notification. If you correct data you had already disclosed, you must tell each recipient unless impossible or disproportionate, and tell the person who they were if asked. Routinely missed. See disclosures to third parties.
Accuracy disputed, so restrict. Where someone contests accuracy and you disagree, restriction is the designed answer: pause while you verify rather than dig in. It is the most underused right and often defuses a stand-off.
Objection where the basis is legitimate interests. An objection puts the burden on you to demonstrate compelling legitimate grounds overriding their interests. If your assessment was never written down, you are constructing it under pressure and after the fact. See the legitimate interests assessment.
Erasure where you rely on consent. Withdrawing consent is not itself an erasure request, but it usually removes your basis, which often triggers one. Handle both.
For the person exercising a right
Name the right and the article, state what you want done, and set a date. If you are exercising two, say so explicitly and number them: the most common way a request goes half-answered is that it contained two and looked like one.
For the controller
Build one intake that recognises all eight rather than a process for access and ad-hoc handling for the rest. The mechanics are shared, so the marginal cost of covering all eight is small, and the failures cluster entirely in the seven that were improvised.