Data subject rights under the GDPR: what your company has to answer

Which rights do people have against your company?

Everyone whose data you process has these rights: access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21). There is also the right not to be subject to a decision made solely by automated means with legal or similarly significant effects (Art. 22).

That applies to employees, applicants and customers just as to contacts at suppliers. When you rectify, erase or restrict, tell every recipient of the data, unless that is impossible or takes disproportionate effort (Art. 19).

How to answer an access request is covered in our article on access under Art. 15 GDPR.

Art. 15 to 22 GDPR

Which deadline and form apply to every request?

Art. 12 governs all requests under Art. 15 to 22. You tell the person what you have done without undue delay and within one month of receipt at the latest. If requests are complex or numerous, you may extend by two months, giving reasons (Art. 12(3)).

If you refuse, give the reasons within one month and point to the authority and the courts (Art. 12(4)). In principle you answer free of charge; for manifestly unfounded or excessive requests you may charge a reasonable fee or refuse (Art. 12(5)).

For a mid-sized company this means in practice: requests arrive at one address, one person handles them and keeps a list with date of receipt and deadline. For access requests the European Data Protection Board (EDPB) recommends confirming receipt in writing, with the deadline.

Art. 12 GDPR

When do you have to erase data, and when not?

You must erase without undue delay if a ground in Art. 17(1) applies. Examples: the data is no longer needed for its purpose, the person withdraws consent, they object successfully, or the processing was unlawful.

The duty does not apply to the extent you need the data for a legal obligation or for legal claims (Art. 17(3)(b) and (e)). One example is keeping business letters and accounting vouchers under § 147 of the German Fiscal Code (AO).

On the conditions of Art. 23, national law may restrict such rights; the EDPB names §§ 32 to 37 BDSG as an example. With paper files or other non-automated processing, erasure can take disproportionate effort because of how the data is stored. If the person's interest is also low, you restrict processing instead of erasing (§ 35(1) BDSG). That does not apply to unlawfully processed data.

Restriction instead of erasure also applies where data is no longer needed but retention periods set by contract or by the organisation's articles stand in the way (§ 35(3) BDSG). How to set erasure periods in advance is covered in our article on the deletion concept.

Art. 17 · Art. 23 GDPR · § 35 BDSG · § 147 AO

What applies to objection, restriction and data portability?

Anyone can object to direct marketing at any time; you then stop processing their data for it (Art. 21(2) and (3)). There is nothing to weigh up here.

If processing is based on your legitimate interest (Art. 6(1)(f)), the person can object on grounds relating to their particular situation. You may continue if you demonstrate compelling legitimate grounds that override, or need the data for legal claims (Art. 21(1)). You point out both rights to object separately, at the latest at your first communication (Art. 21(4)).

Restriction means the data stays stored, but you use it only in narrow cases, such as with consent or for legal claims (Art. 18(2)). The person can ask for it, for example, while you check whether contested data is accurate.

Data portability covers data the person has provided to you and that you process by automated means on the basis of consent or a contract. They receive it in a structured, commonly used and machine-readable format (Art. 20(1)).

Art. 18 · Art. 20 · Art. 21 GDPR

An example: a customer wants to be deleted

A customer of the fictional Kraus Elektro GmbH (60 staff) writes to his contact in sales: “Delete all my data and stop sending me the newsletter.” That is two requests: an objection to direct marketing and a request for erasure.

Sales forwards the email at once. For access requests sent to an assigned regular contact, the EDPB expects exactly that, and we read it the same way for other requests. The address comes off the mailing list immediately. The company deletes the customer account and old quotes and tells the service provider that sends the newsletter (Art. 19).

The invoices stay, because § 147 AO requires keeping them. Within one month the company writes to the customer what has been deleted, what stays and why. Two mistakes would be easy: deleting the invoices too, or leaving the email lying in sales.

With an AI assistant

An AI assistant such as Claude, ChatGPT or Copilot can sort incoming requests: which right is meant, which deadline is running, which software is affected. It drafts answers in the clear language Art. 12(1) asks for.

The weighing is your company's: whether compelling grounds override an objection, whether an exception to erasure applies, whether a request is excessive.

If you give an assistant requests with names and data, its vendor processes them too; check first that a data processing agreement is in place (Art. 28 GDPR). A GDPR walkthrough on nisd2.eu is in the works, with the same MCP server as the NIS 2 walkthrough.