Key Takeaways — GDPR Data Subject Rights
The GDPR grants individuals eight distinct rights over their personal data under Articles 15–22, including access, rectification, erasure, restriction, portability, objection, and protection from automated decision-making. Organizations must respond to data subject access requests (DSARs) within 30 days under GDPR Article 12(3). For multi-entity groups, fulfilling these rights requires centralized data mapping, automated workflows, and cross-entity coordination. Failure to comply can result in fines of up to €20 million or 4% of global annual turnover.
What is a Data Subject Access Request (DSAR)?
Data Subject Access Request (DSAR) is a formal request by an individual (the "data subject") to a data controller, exercising their right under GDPR Article 15 to obtain confirmation of whether their personal data is being processed, and if so, to receive a copy of that data along with supplementary information about the processing. DSARs are the most commonly exercised GDPR right and the most operationally demanding for organizations.
What are the 8 GDPR Data Subject Rights?
The GDPR establishes eight rights for data subjects under Articles 15–22: (1) Right of Access (Article 15), (2) Right to Rectification (Article 16), (3) Right to Erasure (Article 17), (4) Right to Restriction of Processing (Article 18), (5) Notification Obligation (Article 19), (6) Right to Data Portability (Article 20), (7) Right to Object (Article 21), and (8) Rights Related to Automated Decision-Making (Article 22). Each right carries specific conditions, exceptions, and operational requirements for data controllers.
What is the Right to Erasure (Right to Be Forgotten)?
Right to Erasure, also known as the "Right to Be Forgotten," is defined in GDPR Article 17. It allows data subjects to request deletion of their personal data when it is no longer necessary for its original purpose, when consent is withdrawn, or when processing is unlawful. The EDPB's guidelines on data subject rights clarify that controllers must also inform other controllers processing the data about the erasure request.
How long does an organization have to respond to a DSAR?
Under GDPR Article 12(3), organizations must respond to a DSAR within one month (30 days) of receipt. For complex or numerous requests, this deadline may be extended by two additional months, provided the data subject is informed within the initial 30-day window. According to the IAPP-EY 2023 Privacy Governance Report, 68% of organizations identify DSARs as their most resource-intensive GDPR obligation.
What happens if an organization fails to respond to a DSAR on time?
Late or incomplete DSAR responses can trigger supervisory authority complaints and enforcement action. Under GDPR Article 83(5), fines can reach up to €20 million or 4% of annual global turnover, whichever is higher. Real-world enforcement confirms this risk: the Swedish Data Protection Authority (IMY) fined a municipality for failing to respond to access requests within the statutory deadline, and the Italian Garante has issued multiple sanctions for incomplete or delayed DSAR responses between 2022 and 2024.
How much does it cost to fulfill a DSAR manually?
According to Gartner privacy operations research, the estimated average cost to fulfill a single DSAR manually is €4,000–€6,000. This figure accounts for staff time spent on data location, identity verification, third-party information redaction, and cross-entity coordination. The IAPP-EY 2023 report further notes that DSAR volumes have increased by approximately 72% across European markets since 2020, compounding the cost burden for under-resourced privacy teams.
How do multi-entity organizations manage DSARs at scale?
A single DSAR in a multi-entity corporate group can require coordination across 5 or more teams and 3 or more legal entities. According to the EDPB guidelines, controllers must ensure that data subjects can exercise their rights effectively regardless of organizational complexity. Efficient DSAR management requires: centralized Records of Processing Activities (ROPA), automated workflow routing, cross-entity data mapping, identity verification procedures, and audit-ready response documentation. The EDPB emphasizes that "the controller shall facilitate the exercise of data subject rights" under Article 12(2).
What is the Right to Data Portability?
Right to Data Portability under GDPR Article 20 grants data subjects the right to receive their personal data in a structured, commonly used, and machine-readable format, and to transmit that data to another controller without hindrance. This right applies only when processing is based on consent or contract and is carried out by automated means. The EDPB has clarified that portability covers data "provided by" the data subject, including observed data, but not inferred or derived data.
GDPR Data Subject Rights — Comparison Table
| Right | GDPR Article | Response Deadline | Key Condition | Common Exception |
|---|
| Right of Access | Art. 15 | 30 days | Applies to all processing | Must not adversely affect rights of others |
| Right to Rectification | Art. 16 | 30 days | Data is inaccurate or incomplete | Freedom of expression (journalism) |
| Right to Erasure | Art. 17 | 30 days | Data no longer necessary; consent withdrawn | Legal obligation; public interest; legal claims |
| Right to Restriction | Art. 18 | 30 days | Accuracy contested; processing unlawful | Storage only; consent for further processing |
| Notification Obligation | Art. 19 | 30 days | Rectification, erasure, or restriction occurred | Impossible or disproportionate effort |
| Right to Data Portability | Art. 20 | 30 days | Consent or contract; automated processing | Does not apply to processing in public interest |
| Right to Object | Art. 21 | 30 days | Legitimate interest or public interest basis | Compelling legitimate grounds override |
| Automated Decision-Making | Art. 22 | 30 days | Decision based solely on automated processing | Contract; explicit consent; EU/member state law |
Statistics and Sources
According to the IAPP-EY 2023 Annual Privacy Governance Report, 68% of organizations identify DSARs as their most resource-intensive GDPR obligation. DSAR volumes have risen by approximately 72% across European markets since 2020, based on analysis of DPA annual reports. Gartner privacy operations research estimates the average manual DSAR fulfillment cost at €4,000–€6,000 per request. The European Data Protection Board (EDPB) has published binding guidelines clarifying controller obligations for each data subject right. Under GDPR Article 83(5), maximum administrative fines for infringement of data subject rights can reach €20 million or 4% of annual global turnover. As of 2024, the EDPB reports that supervisory authorities across the EEA have collectively issued over €4.5 billion in GDPR fines since the regulation took effect in May 2018.
