Data subject rights

Data subject rights are the legal rights of the person a record is about, called the data subject. An organisation must respect these rights as part of data protection; they are not optional good practice.

Subject access means you can ask to see all the personal data an organisation holds about you and get copies. For example, a youth theatre group must show a member the contact details and attendance notes it keeps about them. If an organisation refuses to let someone see or obtain copies of their data, it breaks their subject access rights.

The right to be informed means you must be told how your data is used, including whether it is shared or sold. A puzzle app that passes your username to an advertising company should explain this clearly.

Consent is your permission for how your data is used. You also have the right to object to processing, such as asking a music streaming service to stop using your listening history to choose adverts for you.

The right to be forgotten lets you ask an organisation to delete all your personal data. The organisation must act if it has no further use for the data, or if you object to it being used for marketing. This is a right you must request; it is not automatic.

Breach notification means you have the right to be told if there is a breach of your data that is likely to put you at risk. If a climbing centre loses a tablet holding members' emergency contact details, it must tell the people affected when the loss is likely to put them at risk.