Data Subject Rights & Consent
Your first copy of your data is free
When you request access to your personal data, the first copy is free - companies can only charge a reasonable fee for extra copies you ask for afterwards.
Data Subject Rights & Consent
IF THEY SHARED YOUR DATA THEY MUST TELL OTHERS
If a company shared your data with others and you ask for it to be erased, corrected, or restricted, they must pass that request on to every recipient - unless it's impossible or takes disproportionate effort.
Data Subject Rights & Consent
Companies must answer your request in a month
Once you ask a company to act on your GDPR rights, they generally have one month to respond - extendable by two more months for complex requests, but they must tell you if that's happening.
Data Subject Rights & Consent
A default selection is not valid consent
In the Planet49 case, the CJEU ruled that a pre-ticked checkbox does not amount to valid consent - users must take an active, unambiguous step to agree.
Data Subject Rights & Consent
You have eight rights over your own data
GDPR gives individuals eight distinct rights over their personal data, including access, rectification, erasure, and data portability, all set out in Chapter III of the Regulation.
GDPR in a Nutshell
GDPR does not stop at Europe's borders.
Non-EU companies that offer goods or services to, or monitor the behaviour of, people in the EU must comply with GDPR - regardless of where the company itself is based.
Privacy by Design & Data Sharing
One court ruling reshaped global data transfers.
The 2020 Schrems II ruling invalidated the EU-US Privacy Shield framework overnight, forcing thousands of companies to rebuild how they transferred data across the Atlantic.
Data Protection Officers (DPOs)
A DPO cannot be fired for doing their duty.
GDPR protects Data Protection Officers from being dismissed or penalised for properly carrying out their duties.
GDPR & AI
Italy was the first to ban a leading chatbot.
Italy's data protection authority temporarily banned ChatGPT in March 2023 over GDPR concerns, the first such action against a major generative AI tool.
Fines, Penalties & Data Breaches
Meta was fined over a billion euros.
Meta was fined a record 1.2 billion euros by Ireland's Data Protection Commission in May 2023 for unlawfully transferring EU user data to the United States.
Data Subject Rights & Consent
The right to be forgotten isn't absolute.
The right to erasure lets people ask companies to delete their data, but it doesn't apply automatically - exceptions exist for legal claims, public interest archiving, and research.
GDPR & AI
GDPR regulates AI systems that process personal data.
Any AI system that processes personal data must comply with GDPR’s transparency and consent requirements, especially when used for profiling or automated decision-making.