The Rights of an Individual

The Rights of an Individual

Data protection is all about the rights of an individual and the systems you need to have in place to comply with the requests that, sooner or later, you will be faced with from the people whose data you may hold or process.

Knowing what those individual rights are will help you to recognise a request when you encounter one. It will also be a big help when putting the policies in place to deal with them within the required time. Familiarity with these eight key rights will also help you record the requests you receive and recognise the importance of handling and transmitting the data safely and securely.

Here is a breakdown of the rights of an individual regarding data:

The right to be informed

The collection of a person’s data and its subsequent use are things they have a right to be informed about. It’s important to provide the following things:

  • The reasons why you are processing their data
  • How long you intend to retain it and who you will share it with. (This is privacy information, which has to be provided when you collect the data itself)
  • The inform you provide must be transparent, easy to understand and no longer or complex than it needs to be

The right of access

Everyone has the right to access their personal data and other supplementary information by making a ‘subject access request’ (SAR). This request can be made to you verbally or in writing by the person themselves or a third party acting on their behalf.

  • A business usually cannot charge a fee for dealing with a SAR request
  • They have to be dealt with in a timely way, usually within one month of receiving the request (this can be extended if the request is considered complex)
  • The data must be disclosed in a secure way

The right to rectification

Sometimes, data held are inaccurate or incomplete; an individual has the right to have it rectified.

  • This can be done verbally or in writing
  • Similarly to a SAR request, this must be undertaken in a timely fashion, within one calendar month

The right to erasure

The right to be forgotten is one that everyone has, although there are certain extenuating circumstances when not all data can be deleted. This might be as a result of other legal regulations and reasons.

The right to restrict processing

Whether restricted or suppressed, in certain circumstances, an individual does have the right to allow you to store personal data but not to use it.

The right to data portability

As the name implies, data portability gives a person the right to obtain the personal data you hold about them and reuse it for a different service. That might help them find a better bank, a different GP or a cheaper energy supplier.

The right to data portability applies only to information that has been given to a controller.

The right to object

Everyone has the right to voice objections to their data being used for direct marketing. However, under certain circumstances, companies can continue processing data if a compelling reason to do so can be proven.

  • You have to inform an individual about their right to object
  • You can refuse an objection but you need to be aware of the information you have to provide in doing so

Rights around automated decision making and profiling

Automated decision making and profiling eradicates the human element from decision making and evaluating certain things relating to an individual and their data.

  • Businesses can only carry out automated decision making and profiling under certain contractual, legal and explicitly consensual conditions
  • The facility to challenge a decision or request human intervention must be in place
  • Systems must be audited regularly to ensure they are working as they are meant to

For more detailed information relating to the individual’s rights and how you and your business can be fully compliant, visit The Information Commissioner’s Office website, where there is a dedicated breakdown and checklist for each.

Alternatively, reach out via my site for the help and advice of a GDPR specialist.

Knowing your data and how to handle it.

Knowing your data and how to handle it.

It is a sobering thought that every one of us has a long, intricate trail of data out there in the wider world.

Personal data, in the form of email addresses, names, where we live, our families, friends, employment records, IP addresses… Each trail is specific to us; its contents can totally identify us.

However, another trail running parallel to the first with much more sensitive data that, in the wrong hands, could be used to target us, such as our medical histories, sexuality and our gender, race and religion.

-All that, and we haven’t even started to mention Social Media profiles…

Cutting through the confusion

Information about your clients, suppliers, employees and other associates or stakeholders is your responsibility. Knowing exactly what that data is, where it is held (off-site, in the cloud or the filing cabinet, for example,) and the lengths of time you are obliged to keep it for are all important legal requirements.

Michelle Molyneux, Data Protection Officer, Know Your data

If you run a business, you will handle data just like that listed above and doing so is more of a responsibility than ever before.

It’s a worthwhile task to undertake, for legal compliance obviously, but for other reasons too:

  • Upholding people’s rights
  • Acting fast to address issues such as data breeches and cyber crime
  • Plan more focused, effective marketing strategies
  • Your customer relationships and reputation will lift you above the competition
  • You get a secure, organised and data-accurate business

Those are just some of the benefits of handling data correctly, but how on earth do you get to that point?

Don’t panic! Help is out there

If you are confused or concerned by issues surrounding the data you hold, don’t worry. You are not the first, and you are certainly not alone in feeling that way.  The first step, the only step that really matters at the beginning of that journey towards data handling compliance and peace of mind, is this-

Establishing exactly what data you hold

I can’t stress this enough, every data audit and every conversation with a GDPR specialist such as myself begins with a long, careful look at exactly what data you handle. It is THE most important job on day one…

We can then follow the legal framework and guidelines to ensure it is handled in a safe and compliant way.

The Information Commissioner’s Office (ICO) is another valuable resource offering the help, and support businesses need to ensure data privacy. Their website offers simple to understand guides about data protection aimed at SME’s and even checklists and self-assessment tools such as this one.

If your business handles personal data, you should already be familiar with the ICO and the annual data protection fee, unless exempt. You can check if the fee applies to you here.

The ICO is a supervisory body and goes the extra mile to offer help and advice to individuals and organisations.

The excellent book ‘GDPR for Dummies’ by Suzanne Dibble cuts through much of the jargon with straightforward, easy to understand help and advice.

Lastly, but by no means least, there is me! As a certified Data Protection Officer, I can offer the help and support you need to ensure you ‘know your data’, and you’re handling it perfectly.

Why not send me a message, live chat or request a call any time? I’d love to help.