Data Subject Rights & Consent
Your first copy of your data is free
When you request access to your personal data, the first copy is free - companies can only charge a reasonable fee for extra copies you ask for afterwards.
Data Subject Rights & Consent
IF THEY SHARED YOUR DATA THEY MUST TELL OTHERS
If a company shared your data with others and you ask for it to be erased, corrected, or restricted, they must pass that request on to every recipient - unless it's impossible or takes disproportionate effort.
Data Subject Rights & Consent
Companies must answer your request in a month
Once you ask a company to act on your GDPR rights, they generally have one month to respond - extendable by two more months for complex requests, but they must tell you if that's happening.
Data Subject Rights & Consent
A default selection is not valid consent
In the Planet49 case, the CJEU ruled that a pre-ticked checkbox does not amount to valid consent - users must take an active, unambiguous step to agree.
Data Subject Rights & Consent
You have eight rights over your own data
GDPR gives individuals eight distinct rights over their personal data, including access, rectification, erasure, and data portability, all set out in Chapter III of the Regulation.
Data Subject Rights & Consent
The right to be forgotten isn't absolute.
The right to erasure lets people ask companies to delete their data, but it doesn't apply automatically - exceptions exist for legal claims, public interest archiving, and research.