As digitalisation grows, personal data protection has become a central concern for governments, organisations and citizens. For this reason, the European Union adopted the General Data Protection Regulation (GDPR), which has applied since 25 May 2018. The GDPR sets out rules to ensure privacy, the security of personal data and data subject rights.
What are data subject rights?
Data subject rights are among the fundamental pillars of the GDPR. Thanks to them, individuals can protect and manage their own data, for example through access, rectification, erasure and portability. These rights rest on the principles of processing, which we explain in the article on the right to personal data protection. Together, they ensure that organisations process personal data transparently and, as a result, they build trust in the digital environment.
In this article, we analyse each of these rights, their importance and their impact on individuals and organisations. In addition, we show how document management platforms help you respond to requests on time. Finally, we bring together the best practices that ensure compliance, especially when the data subjects are your own workers or contractors’ workers.
Right of access
Data subjects have the right to know whether an organisation processes their personal data. If so, they also have the right to access that data. This right includes access to information such as:
The purposes of the processing.
The categories of personal data concerned.
The recipients to whom the organisation has disclosed or will disclose the data.
The envisaged period for which the data will be stored or the criteria used to determine that period.
The existence of the right to request rectification, erasure or restriction of processing of personal data.
The source of the data, if the organisation did not collect it directly from the data subject.
The existence of automated decision-making, including profiling, and meaningful information about the logic involved, as well as the significance and envisaged consequences of such processing for the data subject.
Right to rectification
Data subjects can ask for inaccurate personal data to be rectified and incomplete data to be completed. Consequently, organisations must respond without undue delay and keep data accurate and up to date.
Right to erasure (‘right to be forgotten’)
This right allows data subjects to request the deletion of their personal data in certain circumstances, such as:
The personal data is no longer necessary for the purposes for which it was collected or processed.
The data subject withdraws the consent on which the processing is based, and there is no other legal ground for the processing.
The data subject objects to the processing, and there are no overriding legitimate grounds for it.
The organisation has processed the personal data unlawfully.
The organisation must erase the personal data to comply with a legal obligation.
Right to restriction of processing
Data subjects can also request restriction of the processing of their personal data in certain situations, such as:
When they contest the accuracy of the data, for a period that allows the organisation to verify it.
When the processing is unlawful and the data subject opposes erasure, requesting restricted use instead.
When the organisation no longer needs the data, but the data subject requires it to establish, exercise or defend legal claims.
When the data subject has objected to the processing, pending verification of whether the organisation’s legitimate grounds override theirs.
Right to object
At any time, data subjects can object to the processing of their data on grounds relating to their particular situation. This right is especially relevant when the organisation processes data for direct marketing purposes.
Right to data portability
Data subjects have the right to receive the personal data they have provided to an organisation. The organisation provides it in a structured, commonly used and machine-readable format. In addition, data subjects have the right to transmit that data to another organisation without hindrance. However, this right only applies when the processing is based on consent or a contract and is carried out by automated means.
Right not to be subject to automated decision-making
Furthermore, data subjects have the right not to be subject to decisions based solely on automated processing, including profiling. This applies to decisions that produce legal effects or similarly significantly affect them. Thus, this right ensures that no important decision about a person takes place without human involvement.
Right to be informed
Finally, data subjects have the right to receive information about the collection and use of their personal data. Therefore, organisations must explain clearly and transparently how they will use the data. For example, they must state the identity of the controller, the purposes of the processing and any other relevant aspects.
How document management platforms help uphold these rights
Indeed, GDPR rights only work if the organisation can locate each data subject’s information and respond on time. For this reason, document management platforms play a very relevant practical role:
| Right or obligation | How the platform helps |
|---|---|
| Right of access | Search for all documents linked to a person and organised export |
| Right to rectification | Data updates with a change history |
| Right to erasure | Controlled deletion, logged and in line with legal retention periods |
| Right to portability | Export in structured, machine-readable formats |
| Storage limitation | Automatic deletion or anonymisation rules |
| Security | Access control, encryption and activity logs |
How data subjects exercise their rights in practice
Exercising these rights is, as a rule, free of charge. The controller must respond within one month, which can be extended by two further months in complex cases. The controller may also request additional information to confirm the requester’s identity, especially when the request involves sensitive documents.
If data subjects believe the organisation has not respected their rights, they can lodge a complaint with the Portuguese Data Protection Authority (CNPD). They can also take the matter to court. Therefore, organisations should handle these requests rigorously.
Best practices for responding to data subject requests
To meet deadlines without improvising, it helps to have a simple internal procedure:
- A single channel for receiving requests.
- A person responsible for reviewing each request, such as the data protection officer.
- Confirmation of the requester’s identity before releasing personal data, so that third parties cannot obtain information improperly.
- A response template for each type of right.
- A log of all requests handled, with dates and decisions.
Rights in the employment context
On document management platforms, many data subjects are workers, either your own or those of contractors. In this context, some rights have limits. For example, a worker cannot demand the erasure of documents that the law requires the company to keep, such as training or accident records. Similarly, the right to object does not apply when processing results from a legal obligation.
Therefore, at the time of collection, the organisation should clearly explain which documents it requests, why, and how long it keeps them. It should also ensure that only authorised people can access those documents.
Practical examples
Access request from a former worker
Imagine that a former worker of a contractor asks the client company for access to all the data it holds about them. Without a platform, the response would require searching through emails, shared folders and paper archives.
With the platform, however, the data protection officer searches by the worker’s identifier. Within minutes, they obtain the list of documents, upload dates and recorded access. Next, they confirm the requester’s identity and prepare the response on time. As a result, the organisation complies with the GDPR with less effort and greater rigour.
Rectification request from a subcontractor’s worker
In another case, a subcontractor’s worker notices that the client’s platform has the wrong date of birth for them. Because this error prevents the validation of their training certificate, they request rectification through the designated channel.
The person responsible confirms the worker’s identity, corrects the data and records the change. Finally, they inform the subcontractor and the worker. Consequently, the certificate validation moves forward, and the platform history shows that the organisation handled the request on time.
Frequently asked questions
Can the organisation charge for responding to an access request?
As a rule, no. It can only charge a reasonable fee for additional copies or when requests are manifestly unfounded or excessive, for example because they are repetitive.
Does the organisation always have to erase data when the data subject asks?
No. The right to erasure has exceptions, for example when retention is necessary to comply with a legal obligation or to defend legal claims.
How long does the organisation have to respond?
As a rule, one month from receipt of the request. This period can be extended by two further months in complex cases, provided the organisation informs the data subject within the first month.
Are external workers’ documents also covered?
Yes. Contractors’ workers are data subjects like any others. Therefore, the client company must inform them about the processing, limit the documents requested to what is necessary and set retention periods.
Conclusion on data subject rights
The GDPR has significantly changed the way organisations process personal data. In fact, it has placed data subject rights at the heart of data protection practices. Through access, rectification, erasure and portability, the GDPR gives individuals greater control over their data. Moreover, it demands greater transparency and accountability from organisations.
How to guarantee data subject rights
For companies, GDPR compliance is a legal obligation, but also an opportunity to build trust with clients, workers and contractors. Above all, guaranteeing these rights requires appropriate technologies, clear policies and well-defined processes. It also requires ongoing employee training and a privacy culture within the organisation.
In this context, document management platforms make these rights effective, because they allow organisations to respond to requests on time, rigorously and with full traceability. In short, organisations that respect data subject rights avoid penalties and strengthen the trust of those who share their data with them.
Read also: Adapting document management platforms to GDPR guidelines and The importance of encryption in data protection.
For more information on exercising these rights in Portugal, visit the Portuguese Data Protection Authority (CNPD).