Rights of the data subject

The rights of the data subject are the entitlements granted to individuals by Chapter III (Art. 12 to 23) of the GDPR, enabling them to know about and exercise control over the processing of their personal data.

• Right to information (Art. 13 and 14): transparent information about the processing at collection.
• Right of access (Art. 15): confirmation, a copy of the data and related information.
• Right to rectification (Art. 16): correction of inaccurate or incomplete data.
• Right to erasure (Art. 17), the "right to be forgotten", in defined circumstances.
• Right to restriction of processing (Art. 18).
• Right to data portability (Art. 20) for data provided by the individual and processed by automated means on the basis of consent or contract.
• Right to object (Art. 21), including an absolute right to object to direct marketing and a specific right in the research context.
• Right not to be subject to solely automated decisions (Art. 22).

Art. 12 sets the common modalities: requests must be facilitated, answered within one month (extendable by two), free of charge unless manifestly unfounded or excessive, and refusals must be reasoned. Art. 23 allows Member States to restrict rights for listed public interests, and Art. 89(2) allows derogations from access, rectification, restriction and objection for scientific research where the rights would seriously impair the research, provided the Art. 89(1) safeguards apply and national law provides for the derogation. Rights are exercised against the controller; for pseudonymised clinical trial data this usually means going through the investigator site. A written data subject request procedure agreed between sponsor, site and CRO is a standard deliverable of a trial's data protection set-up.