You have real rights over your personal data, and most people never use them. It is easy to feel stuck when a company is using information about you and you cannot even see what they collected. European data protection law gives you the right to access that data, correct it, delete it, and several other ways to stay in control. This article walks through those rights, how to use them, and what companies have to do when you ask.

What the GDPR means for your rights

The General Data Protection Regulation (GDPR) is the core of European data protection law. Since 25 May 2018 it has set the rules for how organisations handle personal data about real people. It applies in every EU member state, and the rules are meant to be the same everywhere, or close to it. That makes life simpler for companies operating in more than one country, and it makes your rights stronger, because a company cannot dodge them by pointing at a different member state.

The GDPR gives you three things that matter in practice:

Transparency about how your personal data is processed
Control over that data
Protection against misuse and processing you never agreed to

You have the right to know which categories of personal data are collected about you, how they are used, and what to do when an organisation ignores the rules.

Right of access: see what is stored about you

The right of access, Article 15 of the GDPR, is what makes the rest of this usable. It lets you find out which personal data an organisation stores or processes about you. In principle you can send a free access request to any company that handles your data in some form. You can usually ask again every three months.

A proper answer covers:

what data they hold
why they process it
where it came from, if they did not collect it from you
who else receives it

That last point is how you decide whether to ask for a correction or a deletion next. You can also ask for a copy of the personal data they hold.

Right to rectification: fix data that is wrong

Wrong or incomplete data about you is not a small thing. It can feed a decision that costs you money, a job, or a loan. The right to rectification is how you make an organisation correct it. They have to fix inaccurate data when you ask.

To use it:

Find the data that is wrong or incomplete. Read what they sent you and mark what has to change.
Send a rectification request. The data protection officer is the right address. Customer support will do if you cannot find one. Say what is wrong and what it should say.
Follow it through. They have to look at the request and update the data. If the answer is not good enough, you can go to a supervisory authority.

Right to erasure: get your data out of their databases

The right to erasure, often called the "right to be forgotten", lets you demand that your data be deleted when certain conditions are met. Typical cases: they no longer need it for the purpose they collected it for, or you have withdrawn your consent. It is one of the stronger levers the GDPR gives you over your own information.

To use it well:

Decide which data should go.
Contact the controller. That is the data protection officer, or whoever is actually processing the data.
Say why deletion is justified under the GDPR.

Right to data portability: take your data with you

The right to data portability means you can receive your personal data in a structured, commonly used, machine-readable format. It matters most when you want to leave a service. You can:

move the data from one provider to another
store it on your own devices
keep it somewhere you can actually inspect

Write the request so it is specific. The controller has to hand the data over without undue delay, in a format another service can read. The right applies where the processing is automated.

Right to object: say no to the processing

You can object to the processing of your data. If a use does not sit right with you, you can refuse it. This is especially useful for marketing: you can object, and you do not have to give a reason.

To use it:

Contact the data protection officer of the organisation processing your data.
Tell them you object to the processing.
Ask for confirmation that the objection was accepted and acted on.

Right to compensation: when a breach costs you

If your personal data is processed unlawfully and that causes you harm, you can claim compensation. That includes harm that is not a line on a bank statement.

To start a claim:

Name the harm. Stress, a loss of privacy, a concrete loss.
Keep the evidence. How the data was misused, and what it did to you.
Tell the data protection officer what happened and that you intend to claim. Talk to a lawyer before you file the claim itself.

How Datapods makes these rights usable

Datapods gives you a straightforward way to exercise these rights without writing a fresh letter to every company.

Your Datapod can:

use your right of access, so you can see what companies store about you
use your right to rectification, so wrong information gets corrected
use your right to erasure whenever you want data gone

Sign up at Datapods and take the control back.

Frequently asked questions

Which data protection rights do you have?

You can ask for access, rectification, erasure, restriction of processing, and portability. You can object to processing, and you can claim compensation when a breach harms you.

What is data protection law?

Data protection law is the set of rules about your personal data. It gives you rights, and it limits companies and public authorities to processing that the law allows.

Your data protection rights, and how they protect you