Overview

This article requires organizations to provide clear, concise, and easily accessible information about how personal data is processed. Organizations must ensure that data subjects can exercise their rights effectively, including access, correction, deletion, and objection, with responses provided in a timely and understandable manner.


Key Principles

  • Clarity and Accessibility: Information must be presented in plain, easy-to-understand language.

  • Timely Response: Responses to data subject requests must be provided within one month, with justified extensions if necessary.

  • Facilitating Rights: Support the exercise of rights such as access, rectification, erasure, restriction, portability, and objection.

  • Accountability: Justify any refusal to act on a request and provide information about complaint options.

  • Proportionality: Excessive or repetitive requests may incur reasonable fees or be refused.

Organizational Applicability

This article applies to all organizations that process personal data within the EU:

  • Organizations acting as controllers responsible for providing information and responding to data subject requests.

  • Public and private sector entities obligated to uphold transparency and accountability.

  • Teams managing customer service, privacy requests, legal compliance, or data protection operations.

Implementation Requirements

  • Develop procedures to provide clear and concise information to data subjects.

  • Implement processes to respond to data subject rights requests within required timelines.

  • Maintain records of requests, responses, and justifications for non-action or delayed responses.

  • Establish rules for handling excessive requests, including possible fees or refusal.

Implementation Guidance

  • Use plain language templates for privacy notices, rights information, and response letters.

  • Train staff to handle data subject requests efficiently and consistently.

  • Monitor deadlines and track all requests in a centralized system to ensure compliance.

  • Review procedures periodically to ensure effectiveness and alignment with GDPR requirements.

Periodic Review

  • Frequency: Annually or whenever changes occur in privacy policies or request handling procedures.

  • Responsible Role: Data Protection Officer (DPO) or Compliance Team.

  • Outcome: Ensure transparency practices are effective, requests are handled timely, and non-action justifications are properly documented.

Non-Compliance Risks

  • Fines: Up to €20 million or 4% of global annual turnover.

  • Legal Exposure: Complaints or enforcement actions for failure to provide information or facilitate rights.

  • Reputational Damage: Loss of trust from data subjects, partners, and regulators.

  • Operational Risk: Inefficient handling of data subject requests leading to regulatory scrutiny.