Examples
Worked examples
- Is an instance
A former cohort participant submits a subject-access request to the university; the research-data office collates all identifiable records and provides a copy within thirty days.
- Is an instance
A participant requests rectification of an incorrect date of birth in a registry; the controller corrects the entry and notifies downstream processors.
Counter-examples
Looks similar, but isn't
- Not an instance
A request to inspect a colleague's research data is not a data-subject right where the requester is not the data subject of that data.
- Not an instance
Requests concerning fully anonymous data fall outside the GDPR because there is no longer an identifiable data subject.
Editorial commentary
Controllers must facilitate the exercise of these rights, respond to requests without undue delay and in any event within one calendar month (extendable by two further months for complex requests), and must do so free of charge except where requests are manifestly unfounded or excessive. In a research context, Articles 14(5)(b), 17(3)(d), 21(6) and 89 permit specific derogations where the application of certain rights would seriously impair the achievement of the research purposes and appropriate safeguards are in place; institutions must document these derogations and explain them in participant information.
References
- GDPR Regulation (EU) 2016/679 Chapter III Articles 12-22
- European Data Protection Board Guidelines 01/2022 on data subject rights – right of access
- UK Information Commissioner's Office Guide to the UK GDPR: Individual Rights
Also known as
GDPR rights · Chapter III rights · data-subject access rights
Machine-readable encodings
Use in your systems
<role vocab="credit"
vocab-identifier="https://casrai.org/dictionary/"
vocab-term="Data subject rights (GDPR)"
vocab-term-identifier="https://casrai.org/dictionary/term/data-subject-rights-gdpr" />{
"@context": "https://schema.org",
"@type": "DefinedTerm",
"name": "Data subject rights (GDPR)",
"identifier": "https://casrai.org/dictionary/term/data-subject-rights-gdpr",
"description": "The collective set of rights conferred on identifiable individuals by Chapter III of the GDPR (Articles 12-22), including the rights to be informed, of access, to rectification, to erasure, to restriction of processing, to data portability, to object, and not to be subject to solely automated decision-making with legal or similarly significant effects.",
"inDefinedTermSet": "https://casrai.org/dictionary/domain/compliance-and-regulatory/",
"url": "https://casrai.org/dictionary/term/data-subject-rights-gdpr",
"sameAs": [
"GDPR rights",
"Chapter III rights",
"data-subject access rights"
],
"license": "https://creativecommons.org/licenses/by/4.0/"
}
