Data Subject Rights: The Glossary and Process for Managing Them in Business

01

What is needed to manage data subject rights

An effective business process starts with the information the data controller must provide to the data subject: retention period, legal basis, existence of rights of access, rectification, erasure, restriction, objection and portability, and the right to lodge a complaint with a supervisory authority.

If the processing is based on consent, the right to withdraw it at any time must also be indicated, without affecting the lawfulness of processing already carried out.

02

The basic glossary to get oriented

• Supervisory authority: the independent public authority established by a Member State.
• Main establishment: the place of central administration in the Union of the controller or processor.
• Representative: a person designated in writing to represent the controller or processor in the Union.
• Cross-border processing: processing that affects data subjects in more than one Member State.
• Relevant and reasoned objection: a challenge demonstrating significant risks to the rights and freedoms of data subjects.

03

The step-by-step operational flow

Steps

1. Register the request and verify the identity of the data subject.
2. Identify the legal basis for the processing and the data involved, including any legitimate interest.
3. Provide the information within one month of obtaining the data, or at the latest at the first communication with the data subject.
4. Indicate the source of the data, if from publicly accessible sources, and the existence of any automated decisions.
5. Review the process when risks related to processing activities change.

04

A hypothetical case: an access request at a small business

Scenario: a customer asks what data the company holds about them. The process owner verifies identity, identifies the legal basis for processing, and prepares a response within the one-month deadline.

The response includes the expected retention period, the source of the data, and information about the right to lodge a complaint with a supervisory authority.

05

Minimum checks to include

• Verify that each response indicates the data retention criteria.
• Check that the right to object and to data portability is mentioned.
• Confirm the indication of the right to withdraw consent, where applicable.
• Verify the presence of information on any automated decisions and the logic used.

06

What a company can set up with the support of management software

A company can choose to track, in a software system, the information to be provided for each request: retention period, legal basis, source of the data, and presence of automated processing.

It can also assign roles and responsibilities for request intake and plan a periodic review of the process when the risk level changes, as a suggested operational choice rather than an automatic obligation of the software.

07

Frequently asked questions in summary

• The minimum information concerns retention, legal basis, rights, and the source of the data.
• Expected response times range from a reasonable period up to a maximum of one month.
• The process should be reviewed when changes in processing risk arise.

08

Next step

Map the information your company already provides to data subjects and compare it with the list set out in Article 13(2): retention, rights, source of the data, and automated decisions. From here you can build a verifiable and traceable process.