Examples
Worked examples
- Is an instance
A former cohort participant submits a subject-access request to the university; the research-data office collates all identifiable records and provides a copy within thirty days.
- Is an instance
A participant requests rectification of an incorrect date of birth in a registry; the controller corrects the entry and notifies downstream processors.
Counter-examples
Looks similar, but isn't
- Not an instance
A request to inspect a colleague's research data is not a data-subject right where the requester is not the data subject of that data.
- Not an instance
Requests concerning fully anonymous data fall outside the GDPR because there is no longer an identifiable data subject.
Editorial commentary
Controllers must facilitate the exercise of these rights, respond to requests without undue delay and in any event within one calendar month (extendable by two further months for complex requests), and must do so free of charge except where requests are manifestly unfounded or excessive. In a research context, Articles 14(5)(b), 17(3)(d), 21(6) and 89 permit specific derogations where the application of certain rights would seriously impair the achievement of the research purposes and appropriate safeguards are in place; institutions must document these derogations and explain them in participant information.
The eight rights comprise the right to be informed (Articles 13-14), of access (Article 15), to rectification (Article 16), to erasure (Article 17), to restriction of processing (Article 18), to data portability (Article 20), to object (Article 21), and rights related to solely automated decision-making including profiling (Article 22). CASRAI maintains dedicated entries on the right to erasure and on Article 22 automated decision-making in research; the remaining rights are addressed here rather than as separate pages, since none currently carries research-specific complexity distinct from the general GDPR position.
Before acting on a request, a controller must verify the requester’s identity, and may refuse to act or charge a reasonable administrative fee only where the request is manifestly unfounded or excessive, in particular because of its repetitive character — the burden of demonstrating that rests with the controller, not the requester.
References
- GDPR Regulation (EU) 2016/679 Chapter III Articles 12-22
- European Data Protection Board Guidelines 01/2022 on data subject rights – right of access
- UK Information Commissioner's Office Guide to the UK GDPR: Individual Rights
Also known as
GDPR rights · Chapter III rights · data-subject access rights
Machine-readable encodings
Use in your systems
<role vocab="credit"
vocab-identifier="https://casrai.org/dictionary/"
vocab-term="Data subject rights (GDPR)"
vocab-term-identifier="https://casrai.org/dictionary/term/data-subject-rights-gdpr" />{
"@context": "https://schema.org",
"@type": "DefinedTerm",
"@id": "https://casrai.org/dictionary/term/data-subject-rights-gdpr",
"name": "Data subject rights (GDPR)",
"identifier": "https://casrai.org/dictionary/term/data-subject-rights-gdpr",
"description": "The collective set of rights conferred on identifiable individuals by Chapter III of the GDPR (Articles 12-22), including the rights to be informed, of access, to rectification, to erasure, to restriction of processing, to data portability, to object, and not to be subject to solely automated decision-making with legal or similarly significant effects.",
"inDefinedTermSet": "https://casrai.org/dictionary/domain/compliance-regulatory#set",
"url": "https://casrai.org/dictionary/term/data-subject-rights-gdpr",
"alternateName": [
"GDPR rights",
"Chapter III rights",
"data-subject access rights"
],
"license": "https://creativecommons.org/licenses/by/4.0/",
"publisher": {
"@id": "https://casrai.org/#organization"
},
"author": {
"@id": "https://casrai.org/#editorial-team"
},
"datePublished": "2026-05-21T02:22:53",
"dateModified": "2026-09-05T14:25:19",
"inLanguage": "en-GB",
"isAccessibleForFree": true
}
