Manage your personal data
The General Data Protection Regulation allows you to exercise, before the data controller, the rights of access, rectification, objection, erasure (“right to be forgotten”), restriction of processing, portability, and not to be subject to individual automated decisions.
Right of access
It allows the data subject to request from the data controller information about whether or not their personal data is being processed and, if so, to obtain:
- A copy of the personal data undergoing processing
- The purposes of the processing
- The categories of personal data being processed
- The recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organizations
- The envisaged period of storage of the personal data or, if not possible, the criteria used to determine this period
- The existence of the right of the data subject to request from the controller: the rectification or erasure of their personal data, the restriction of processing, or to object to such processing
- The right to lodge a complaint with a Supervisory Authority
- When the personal data have not been obtained directly from the data subject, any available information about their origin
- The existence of automated decision-making, including profiling, and, at least in such cases, meaningful information about the logic involved and the significance and envisaged consequences of such processing for the data subject
- When personal data are transferred to a third country or an international organization, the right to be informed of the appropriate safeguards relating to the transfer
Form for exercising the right of access before the personal data controller.
Right of rectification
It allows inaccurate personal data to be rectified without undue delay by the data controller.
If the purposes of the processing allow it, you may request that incomplete personal data be completed, including by providing an additional statement.
The request must indicate which data it refers to and the correction you wish to make. In addition, when necessary, you must attach documentation that justifies the inaccuracy or incomplete nature of your data.
Form for exercising the right of rectification before the personal data controller.
Right to object
It allows the data subject to object to the controller processing their personal data in the following cases:
When the data are processed based on a task carried out in the public interest or on legitimate interest, including profiling, the controller shall stop processing the data unless they demonstrate compelling legitimate grounds that override the interests, rights, and freedoms of the data subject, or for the establishment, exercise, or defense of legal claims.
When the processing is carried out for direct marketing purposes, including profiling related to such marketing, the personal data shall no longer be processed for those purposes.
Form for exercising the right to object before the personal data controller.
Right to erasure (“right to be forgotten”)
By exercising this right, the data subject may request the controller to erase their personal data when any of the following circumstances apply:
- If the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed
- If the processing of your personal data was based on the consent you once gave to the controller, and you later withdraw it, provided that the processing is not based on another lawful ground
- If you have exercised your right to object and the following circumstances apply:
- The controller’s processing was based on legitimate interest or on the performance of a task carried out in the public interest, and no other grounds prevail to justify the processing of your data, or when the personal data are processed for direct marketing purposes, including profiling
- If the personal data have been unlawfully processed
- If the personal data must be erased for compliance with a legal obligation under Union or Member State law applicable to the controller
- If the personal data have been obtained in relation to the offer of information society services referred to in Article 8(1) (conditions applicable to the processing of minors’ data in relation to information society services)
Furthermore, the GDPR links this right to the so-called “right to be forgotten,” so that this right to erasure is expanded in such a way that the controller who has made personal data public is obliged to inform other controllers processing such data to erase any links to them, or any copies or replicas of such data.
However, this right is not unlimited, and erasure may not proceed when processing is necessary for the exercise of freedom of expression and information, for compliance with a legal obligation, for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller, for reasons of public interest in the area of public health, for archiving purposes in the public interest, for scientific or historical research purposes, for statistical purposes, or for the establishment, exercise, or defense of legal claims.
Form for exercising the right to erasure before the personal data controller.
Right to restriction of processing
Its exercise has two aspects:
Suspension of processing:
- When the accuracy of the personal data is contested, for a period enabling the controller to verify it
- When the right to object to the processing of personal data carried out by the controller based on legitimate interest or a task in the public interest has been exercised, while it is verified whether these grounds override yours
- Retention of the data:
- When the processing is unlawful and the right to erasure has been exercised but the restriction of use is requested instead
- When the controller no longer needs the personal data for the purposes of the processing, but the data subject needs them for the establishment, exercise, or defense of legal claims
Form for exercising the right to restriction of processing before the personal data controller.
Right to data portability
When processing is carried out by automated means, the data subject may receive their personal data in a structured, commonly used, machine-readable, and interoperable format, allowing them to transmit it to another controller, provided that the processing is based on consent or carried out within the framework of a contract.
However, due to its nature, this right cannot be applied when processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
Form for exercising the right to data portability before the personal data controller.
Right not to be subject to automated individual decision-making
This right aims to ensure that the data subject is not subject to a decision based solely on the processing of personal data, including profiling, that produces legal effects concerning them or significantly affects them in a similar way.
Regarding profiling, this refers to any form of processing of personal data that evaluates personal aspects, in particular by analyzing or predicting aspects related to job performance, economic situation, health, personal preferences or interests, reliability, or behavior.
However, this right does not apply when:
- It is necessary for entering into or performing a contract between the data subject and the controller
- The processing of your data is based on previously given consent
- In these first two cases, the controller must guarantee the data subject’s right to obtain human intervention, express their point of view, and challenge the decision.
- It is authorized by Union or Member State law and appropriate measures are established to safeguard the rights, freedoms, and legitimate interests of the data subject.
Likewise, these exceptions do not apply to special categories of data (Article 9.1), unless Article 9.2(a) or (g) applies and the appropriate measures mentioned above have been taken.
