Everyone whose personal data you process has specific rights under the GDPR (Articles 12 to 22). Your organization must honor these rights on time, transparently and with proper documentation. Without a procedure, you risk a fine of up to EUR 20 million or 4% of annual global turnover, as well as losing clients’ trust. This guide explains which rights people have, what a procedure should include and how to implement it.
In previous articles, I have already discussed …, which is a foundation of GDPR compliance, as well as the procedure for handling personal data breaches, which is essential when incidents threaten privacy.
What is a procedure for handling data subject rights for?
A procedure for handling data subject rights is a document that sets out the rules and steps an organization must follow to effectively honor the rights of individuals under the GDPR (the General Data Protection Regulation). It helps ensure that people whose data is processed can exercise their rights effectively and transparently, and that the organization meets its obligations lawfully and on time.
What functions does the procedure serve?
- Ensuring GDPR compliance: Articles 12 to 22 of the GDPR give individuals specific rights that the organization must respect and honor.
- Protecting individual rights: the procedure enables data subjects to effectively exercise rights such as access, rectification and erasure.
- Making data processing transparent: it assures individuals that their data is processed in a clear and lawful manner.
- Organizational accountability: implementing the procedure helps demonstrate to supervisory authorities, such as UODO, that the organization acts in accordance with GDPR requirements.
- Building trust: handling rights correctly and promptly strengthens the trust of clients, employees and partners in the organization.
- Reducing the risk of fines: failing to honor people’s rights can result in financial penalties of up to EUR 20 million or 4% of annual global turnover.
What rights do data subjects have?
- Right of access (Article 15 of the GDPR): the right to obtain information about data processing and a copy of the data being processed.
- Right to rectification (Article 16 of the GDPR): the right to correct inaccurate data or complete incomplete data.
- Right to erasure (the “right to be forgotten,” Article 17 of the GDPR): the right to request erasure when data is no longer needed or is being processed unlawfully.
- Right to restriction of processing (Article 18 of the GDPR): the right to temporarily “freeze” data processing.
- Right to data portability (Article 20 of the GDPR): the right to receive one’s data in a format that allows it to be transferred to another controller.
- Right to object (Article 21 of the GDPR): the right to object to data processing, particularly for marketing purposes.
- Right not to be subject to profiling (Article 22 of the GDPR): the right to decisions that are not based solely on automated processing.
- Right to withdraw consent: if consent is the legal basis for processing, the individual may withdraw it at any time.
What should a procedure for handling data subject rights include?
- Purpose and scope of the procedure
- Explain why the procedure was created and which processes it covers.
- Allocation of responsibilities
- Identify the people responsible for receiving, analyzing and handling requests, such as the Data Protection Officer, IT department or HR department.
- How requests are received
- List the channels for submitting requests, such as email, a paper form, an IT system or telephone.
- Provide a template request or form.
- Verifying the requester’s identity
- Explain how to check that the request came from the right person, for example by confirming identity with an identity document or other information.
- Steps for handling rights requests
- Receive the request and assign it an appropriate number or identifier.
- Analyze the request: assess whether it is justified and whether the organization can fulfill it.
- Respond:
- reply within 1 month, with the possibility of an extension by a further 2 months in justified cases,
- explain why the request cannot be fulfilled if there is a basis for refusing it.
- Fulfill the right, for example by erasing, rectifying or providing the data.
- Document the request by recording it in the rights request register.
- Informing people of the outcome
- Send the response to the data subject in a clear and understandable format.
- Rights request register
- Keep a record of each request, including:
- the submission date,
- the right involved,
- the organization’s decision,
- the date the request was fulfilled or refused.
- Keep a record of each request, including:
- Technical and organizational measures
- Describe the tools the organization uses to honor rights effectively, such as IT tools and staff training.
What does implementing the procedure achieve in practice?
- It helps you respond quickly and effectively to requests from people whose data you process.
- It helps you meet legal obligations under the GDPR.
- It helps avoid financial penalties that can reach EUR 20 million or 4% of annual global turnover.
- It protects the organization’s image and reputation from the negative effects of violations.
How does AI affect the exercise of individual rights?
Artificial intelligence has a significant effect on personal data processing, including how individuals exercise their rights. When implementing AI-based systems, consider the following:
- Automating request handling: AI can help organizations handle requests for access, rectification or erasure efficiently.
- Profiling and the AI Act: individuals should be able to obtain information about how algorithms that make decisions through automated processing work.
- Data minimization: AI should be implemented in accordance with the data minimization principle, so that it processes only information that is actually needed.
- Processing transparency: organizations must inform users how their data is used in AI models.
Summary
A procedure for handling data subject rights is a tool for effectively managing requests related to personal data processing. Implementing it helps an organization maintain GDPR compliance, protect individual rights and ensure transparency. Regularly updating and monitoring the procedure reduces the risk of errors and financial penalties for failing to meet legal obligations.
Would you like to learn how to adapt GDPR procedures in your organization? Contact our law firm. We can help you ensure full compliance with personal data protection requirements.
Q&A: Procedure for handling data subject rights
Who implements the procedure for handling data subject rights?
The company’s management board or a designated department or Data Protection Officer (IOD).
Where should you keep the procedure for handling data subject rights?
In a central document repository, such as a document management system, a personal data protection department database or a paper copy in the responsible department.
How should you make the procedure for handling data subject rights available?
Through the intranet, document management system, email or training for employees involved in handling individual rights requests, with access limited to authorized people.
What are the consequences of failing to honor individual rights?
Failure to handle data subject requests may result in a complaint to the supervisory authority (UODO) and a fine of up to EUR 20 million or 4% of the company’s annual turnover.
How long does an organization have to handle a request?
The standard period is 1 month, but in exceptional situations it may be extended by a further 2 months.
Can an organization refuse a request?
Yes, for example if the data is processed to meet a legal obligation or in the public interest. The refusal must be properly justified.
How can an organization ensure GDPR compliance when handling people’s rights?
The best approach is to implement a clear request-handling procedure, train staff and keep a rights request register.
How does AI affect the exercise of people’s rights?
Artificial intelligence can improve rights-handling processes, but it also creates challenges related to decision transparency and data protection.
