Right to Be Informed
Under Article 12 of the GDPR, comprehensive information about your data processing activity must be provided in an easily accessible way, using plain language.
Right of Access
You can exercise your right under Article 15 of the GDPR to ask for information about any of your personal data that we’re processing. This called a Subject Access Request. You can ask confirmation of whether we’re actually processing your personal data. You can also ask for a copy of such personal data.
Right to Rectification
Under Article 16 of the GDPR, you have the opportunity to ask us to correct any inaccuracies our records show about you.
Right to Erasure
At Article 17 of the GDPR sits the “right to be forgotten.” There’s a bit of public misunderstanding about this right. It doesn’t confer an entitlement for any individual to have any reference to themselves deleted from your website. There is still the the right to freedom of expression. But we will consider erasing personal data under certain conditions.
Right to Restrict Processing
Article 18 of the GDPR grants you the right to ask the data holders to stop processing their data in a particular way. For example, an individual switches electricity suppliers and asks the old supplier to delete all of their personal data. But the old supplier is legally obliged to keep their data on file for eight years. So, instead you can restrict the processing to make sure that they aren’t using the yours data for improper activities.
Right to Data Portability
Under Article 20 of the GDPR, you can request a copy of your personal data from us and take it to another organization. This ties in with the general principle that you should truly own your personal data.
Right to Object
Under Article 21 of the GDPR, you have the right to object to your processing of your personal data. This applies most straightforwardly in the case of direct marketing – users can object to receiving direct marketing. In such a case, there are no exceptions.
Other grounds of objection are more complicated, and data holders may have the right to refuse to stop some types of data processing under certain conditions.
Rights Related to Automated Decision-Making
At Article 22 of the GDPR, you have the right to request human intervention if important decisions are being made about you based on algorithms or profiling.
For example, if a computer decides that an individual’s power should be cut off because they failed to pay their bills, that individual can request that the decision is reviewed by a real person.