Data Governance Atlas

The rights, and how they interact

For both sides

All eight rights in one place — what each obliges, which are qualified, and the interactions that catch organisations out when two are exercised together.

NIST PF CT-PCM-P
ISO 27701 A.7.3.1A.7.3.2A.7.3.6A.7.3.9B.8.3.1
GDPR family Art 12Art 15Art 16Art 17Art 18Art 20Art 21Art 22

Eight rights, none absolute, all sharing one set of mechanics. Organisations tend to build a process for access and improvise the rest, which is where the failures come from.

The shared mechanics

Everything below runs on the same rules: respond without undue delay and within one month; extend by two further months for complex or numerous requests only if you tell the person inside the first month; act free of charge unless the request is manifestly unfounded or excessive; and when refusing, explain why and give the right to complain to the supervisory authority and to a judicial remedy.

There is no prescribed form. A request made in passing, to the wrong department, without citing an article, still counts. Training front-line staff to recognise one matters more than any policy document.

The eight

RightWhat it obligesQualified by
Information (Arts 13-14)Tell people at collection what you do and whyLimited exceptions where they already know, or it is impossible
Access (Art 15)A copy of their data plus supplementary informationThird-party data, privilege, other exemptions
Rectification (Art 16)Correct inaccurate data, complete incomplete dataWhether the data is actually inaccurate
Erasure (Art 17)Delete, in defined circumstancesLegal obligations, claims, freedom of expression, public interest
Restriction (Art 18)Pause processing while something is resolvedAvailable only in defined situations
Portability (Art 20)Provide data in a structured, machine-readable formOnly consent/contract bases, only automated processing
Objection (Art 21)Stop, unless you show compelling groundsAbsolute for direct marketing; balanced otherwise
Automated decisions (Art 22)Not be subject to solely automated significant decisionsContract, law, or explicit consent — with safeguards

Two are narrower than people expect. Portability does not apply to data you inferred or observed under legitimate interestsLegitimate interestsUpdate: DUAA 2025 introduced a \ — it is limited to data the person provided, processed automatically, on consent or contract. Erasure is not a right to be forgotten on demand; it applies in listed circumstances and yields to legal retention duties.

One is stronger than people expect. Objection to direct marketing is absolute. There is no balancing, no assessment, no “compelling grounds” argument. You stop.

The interactions that catch people out

Access then rectification. The standard sequence: a subject access request surfaces something wrong, which becomes a rectification request. Treat the second as a fresh request with its own clock — not as a continuation of the first.

Rectification then notification. If you correct data you had already disclosed, you must tell each recipient unless impossible or disproportionate, and tell the person who they were if asked. Routinely missed. See disclosures to third parties.

Accuracy disputed, so restrict. Where someone contests accuracy and you disagree, restriction is the designed answer: pause while you verify rather than dig in. It is the most underused right and often defuses a stand-off.

Objection where the basis is legitimate interests. An objection puts the burden on you to demonstrate compelling legitimate grounds overriding their interests. If your assessment was never written down, you are constructing it under pressure and after the fact. See the legitimate interests assessment.

Erasure where you rely on consent. Withdrawing consent is not itself an erasure request, but it usually removes your basis, which often triggers one. Handle both.

For the person exercising a right

Name the right and the article, state what you want done, and set a date. If you are exercising two, say so explicitly and number them — the most common way a request goes half-answered is that it contained two and looked like one.

For the controller

Build one intake that recognises all eight rather than a process for access and ad-hoc handling for the rest. The mechanics are shared, so the marginal cost of covering all eight is small — and the failures cluster entirely in the seven that were improvised.

How this differs elsewhere

The page above is written from a GDPR-family default. These are the recorded departures — family entries apply to every jurisdiction in that family at once.

US state privacy acts Works differently Applies to the whole US state acts

A different set: know, delete, correct, opt out of sale/sharing and targeted advertising, limit use of sensitive data, and non-discrimination for exercising them.

Portability exists in a narrower form. There is no general right to object, replaced by specific opt-outs. The non-discrimination right has no GDPR-family equivalent and matters commercially, because it constrains how differently you may treat someone who opted out. Universal opt-out signals must be honoured in several states — a machine-readable mechanism with no counterpart in the GDPR family.

Brazil Additional requirement This jurisdiction only

Includes a right to information about public and private entities with which the controller has shared data, and an explicit right to review of automated decisions.

The sharing-disclosure right is broader than the GDPR-family right of access to recipients, and is exercised directly rather than as part of an access response.

Art 18 LGPD

Where this connects

Sources

Never independently verified.