GDPR Privacy Notice

Data subject rights

The GDPR endows individuals with eight data subject rights, which you should list and explain in your privacy notice:

Right to be informed: organisations must tell individuals what data is being collected, how it’s being used, how long it will be kept and whether it will be shared with any third parties.
Right of access: individuals have the right to request a copy of the information that an organisation holds on them.
Right of rectification: individuals have the right to correct data that is inaccurate or incomplete.
Right to be forgotten: in certain circumstances, individuals can ask for the data an organisation holds on them to be erased from their records.
Right of portability: individuals can request that organisation transfer any data that it holds on them to another company.
Right to restrict processing: individuals can request that an organisation limits the way it uses personal data.
Right to object: individuals have the right to challenge certain types of processing, such as direct marketing.
Right related to automated decision making including profiling: individuals are free to request a review of automated processing if they believe the rules aren’t being followed.