{"id":3931,"date":"2025-03-18T14:57:37","date_gmt":"2025-03-18T14:57:37","guid":{"rendered":"https:\/\/sawaryn.com\/?p=3931"},"modified":"2026-10-23T09:45:41","modified_gmt":"2026-10-23T09:45:41","slug":"gdpr-data-subject-rights-procedure","status":"publish","type":"post","link":"https:\/\/sawaryn.com\/en\/publikacje\/gdpr-data-subject-rights-procedure\/","title":{"rendered":"How to Handle Data Subject Rights Under the GDPR"},"content":{"rendered":"

Everyone whose personal data you process has specific rights under the GDPR (Articles 12 to 22). Your organization must honor these rights on time, transparently and with proper documentation. Without a procedure, you risk a fine of up to EUR 20 million or 4% of annual global turnover, as well as losing clients’ trust. This guide explains which rights people have, what a procedure should include and how to implement it.<\/p>\n

In previous articles, I have already discussed \u2026, which is a foundation of GDPR compliance, as well as the procedure for handling personal data breaches<\/a><\/strong>, which is essential when incidents threaten privacy.<\/p>\n

What is a procedure for handling data subject rights for?<\/h2>\n

A procedure for handling data subject rights<\/strong> is a document that sets out the rules and steps an organization must follow to effectively honor the rights of individuals<\/a><\/strong> under the GDPR<\/strong> (the General Data Protection Regulation<\/a><\/strong>). It helps ensure that people whose data is processed can exercise their rights effectively and transparently, and that the organization meets its obligations lawfully and on time.<\/p>\n

What functions does the procedure serve?<\/h3>\n
    \n
  1. Ensuring GDPR compliance<\/strong>: Articles 12 to 22 of the GDPR give individuals specific rights that the organization must respect and honor.<\/li>\n
  2. Protecting individual rights<\/strong>: the procedure enables data subjects to effectively exercise rights such as access, rectification and erasure.<\/li>\n
  3. Making data processing transparent<\/strong>: it assures individuals that their data is processed in a clear and lawful<\/strong> manner.<\/li>\n
  4. Organizational accountability<\/strong>: implementing the procedure helps demonstrate to supervisory authorities, such as UODO, that the organization acts in accordance with GDPR requirements.<\/li>\n
  5. Building trust<\/strong>: handling rights correctly and promptly strengthens the trust of clients, employees and partners in the organization.<\/li>\n
  6. Reducing the risk of fines<\/strong>: failing to honor people’s rights can result in financial penalties of up to EUR 20 million<\/strong> or 4% of annual global turnover<\/strong>.<\/li>\n<\/ol>\n

    What rights do data subjects have?<\/h2>\n
      \n
    1. Right of access<\/strong> (Article 15 of the GDPR): the right to obtain information about data processing and a copy of the data being processed.<\/li>\n
    2. Right to rectification<\/strong> (Article 16 of the GDPR): the right to correct inaccurate data or complete incomplete data.<\/li>\n
    3. Right to erasure<\/strong> (the \u201cright to be forgotten,\u201d Article 17 of the GDPR): the right to request erasure when data is no longer needed or is being processed unlawfully.<\/li>\n
    4. Right to restriction of processing<\/strong> (Article 18 of the GDPR): the right to temporarily \u201cfreeze\u201d data processing.<\/li>\n
    5. Right to data portability<\/strong> (Article 20 of the GDPR): the right to receive one’s data in a format that allows it to be transferred to another controller.<\/li>\n
    6. Right to object<\/strong> (Article 21 of the GDPR): the right to object to data processing, particularly for marketing purposes.<\/li>\n
    7. Right not to be subject to profiling<\/strong> (Article 22 of the GDPR): the right to decisions that are not based solely on automated processing.<\/li>\n
    8. Right to withdraw consent<\/strong>: if consent is the legal basis for processing, the individual may withdraw it at any time.<\/li>\n<\/ol>\n

      What should a procedure for handling data subject rights include?<\/h2>\n
        \n
      1. Purpose and scope of the procedure<\/strong>\n