Rights of Individuals and Request Management

Introduction and context

Data protection law is not only about restricting organisations; it also gives individuals practical control over information about them. These rights allow a person to understand how data is used, correct inaccurate records, challenge unnecessary processing, obtain usable copies of data, and contest certain decisions. Effective rights management is therefore both a legal obligation and an operational capability.

This chapter uses broadly recognised principles found in modern data-protection frameworks, especially the European Union General Data Protection Regulation (GDPR). Exact rights, exemptions, deadlines, fees, and remedies vary by jurisdiction. Organisations must therefore consult the law applicable to the particular processing activity, individual, and controller. The terms “controller” and “processor” are used in the GDPR sense: a controller determines purposes and means of processing, while a processor acts on the controller’s documented instructions.

A rights request should not be treated as ordinary customer service correspondence. It is a regulated process involving identity verification, scope assessment, searches across systems, third-party rights, security, records management, and communication. Poor handling can cause two different harms: unlawful refusal may deny an individual’s privacy rights, while careless disclosure may expose another person’s confidential information.

Learning objectives

By the end of this chapter, a learner should be able to:

1. Explain the principal rights of individuals in data-protection law.
2. Distinguish access, correction, deletion, objection, restriction, portability, and consent withdrawal.
3. Describe safeguards relating to solely automated decision-making.
4. Design a proportionate workflow for receiving, verifying, assessing, fulfilling, and recording requests.
5. Identify common exemptions, limitations, and conflicts with other legal duties.
6. Apply these concepts to a practical organisational case.

1. The rights framework

Individual rights are grounded in several related principles. Transparency requires people to understand relevant processing. Accuracy requires reasonable steps to keep personal data correct. Storage limitation supports deletion when data is no longer needed. Accountability requires the organisation to demonstrate compliance, not merely assert it.

Rights are usually exercised against the controller. A processor may receive a request, but it normally routes the matter to the controller unless its contract or applicable law assigns it a direct role. The controller remains responsible for establishing procedures and coordinating processors.

Rights are not absolute. They may be limited to protect, for example, the rights of others, legal professional privilege, confidential investigations, public safety, judicial independence, or statutory record-retention duties. A restriction must have a legal basis and should be interpreted narrowly. An organisation should not refuse a complete request merely because one small part is exempt; it should disclose the non-exempt material where possible and explain the withheld portion.

Important terminology

• Data subject: The identified or identifiable individual to whom personal data relates.
• Personal data: Information relating to an identified or identifiable person.
• Processing: Any operation performed on personal data, including collection, storage, consultation, disclosure, alteration, or deletion.
• Controller: The organisation deciding why and how data is processed.
• Processor: A separate organisation processing data for the controller.
• Rights request: A communication in which an individual seeks to exercise a legal data right.
• Identity verification: Proportionate steps to confirm that the requester is the relevant individual or authorised representative.
• Restriction: Marking stored data so that future processing is limited, while retention may continue.
• Portability: Provision of certain personal data in a structured, commonly used, machine-readable format, with transmission to another controller where technically feasible.

2. The right of access

The right of access generally enables an individual to ask whether an organisation processes their personal data and, if so, to receive:

• confirmation that processing occurs;
• a copy of relevant personal data; and
• prescribed supplementary information, such as purposes, categories of data, recipients, retention periods, sources, and information about rights.

Access is not necessarily a right to receive every document in which a person’s name appears. The organisation must provide personal data, while considering third-party privacy, intellectual property, legal privilege, security information, and applicable exemptions. A copy should be intelligible and contextualised sufficiently for the individual to understand the processing.

A request does not normally need to use technical legal language. “Tell me what information you hold about me” may be enough. The organisation may ask for clarification where the request is genuinely broad, but clarification should not become an unnecessary barrier. Under the GDPR, a controller generally responds without undue delay and normally within one month, with a possible extension for complex or numerous requests; the requester must be informed of the reason for an extension.

Repeated or manifestly unfounded or excessive requests may justify a reasonable fee or refusal where permitted by law. The burden of demonstrating that the exception applies rests with the organisation.

Searching for access requests

A defensible search may include customer databases, email, case-management systems, call recordings, human-resources systems, archived records, mobile applications, cloud platforms, and relevant processor systems. Search terms should account for name variations, identifiers, aliases, and date ranges. The organisation should record systems searched, custodians consulted, exclusions made, and review decisions.

3. Correction and completion

The right to rectification allows an individual to correct inaccurate personal data. The related right to completion allows incomplete data to be supplemented, taking account of the purposes of processing. Accuracy is assessed in context. An address may be objectively wrong; a professional opinion or historical note may require a more nuanced response.

Organisations should distinguish:

1. Objective factual error: correct the record when reliable evidence supports the amendment.
2. Disputed opinion: preserve the opinion if properly recorded, but identify that it is an opinion and attach the individual’s response where appropriate.
3. Historical accuracy: do not rewrite a lawful historical record merely because circumstances later changed; add a dated update.
4. Unverifiable information: assess whether retention remains necessary and whether the record should be marked as disputed.

Where data has been disclosed to recipients, the controller may need to communicate the correction to them, subject to applicable law and proportionality. Data-quality controls should also prevent the corrected information from being overwritten by an outdated source.

4. Erasure or deletion

The right to erasure, often called the “right to be forgotten,” may apply where personal data is no longer necessary, consent has been withdrawn and no alternative lawful basis exists, processing is unlawful, or erasure is required by law. It may also apply following a successful objection in relevant circumstances.

Erasure is not an unrestricted right. Retention may be justified for legal obligations, freedom of expression and information, public-interest archiving, public health, legal claims, or other statutory purposes. A financial institution, for example, may have to retain transaction records for anti-money-laundering or tax requirements even after a customer asks for deletion.

Deletion must be understood technically and operationally. Removing a live database record does not necessarily remove backups, audit logs, fraud-prevention records, or information held by processors. Organisations should define retention schedules, distinguish active data from legally required archives, and ensure that data is not restored into production without appropriate deletion controls. Where immediate physical destruction is not feasible, access should be blocked and the data placed beyond ordinary operational use, if the law permits that approach.

5. Objection to processing

The right to object is purpose-sensitive. An individual may object to processing based on their particular situation where the legal basis is a public task or legitimate interests, unless the controller demonstrates compelling overriding grounds or the processing is required for legal claims. Objection to direct marketing, including related profiling, generally has stronger effect: the organisation must stop that processing.

An objection should trigger an assessment, not an automatic rejection. The controller should identify the relevant purpose and lawful basis, evaluate the person’s circumstances, consider whether compelling grounds exist, and communicate the outcome. Marketing suppression lists are a practical example: an organisation may retain minimal information solely to ensure that it does not send further marketing, while ceasing promotional use.

6. Restriction of processing

Restriction is a temporary control that limits processing without necessarily deleting the data. It may be requested when accuracy is contested, processing is unlawful but the individual prefers restriction to deletion, the controller no longer needs the data but the individual needs it for a legal claim, or an objection is under review.

Restricted data should generally be stored but not used, except with the individual’s consent, for legal claims, to protect another person’s rights, or for important public-interest reasons recognised by law. A robust restriction flag must work across linked applications, exports, analytics pipelines, and processor environments. The controller should notify the individual before lifting a restriction, where required.

Restriction is especially useful where deletion would destroy evidence needed for a dispute. It is therefore both a privacy safeguard and a litigation-preservation mechanism.

7. Data portability

Portability supports individual control and competition between services. Where the legal conditions are met, an individual receives personal data they provided to a controller in a structured, commonly used, machine-readable format and may request transmission to another controller where technically feasible.

Portability normally applies when processing is based on consent or contract and carried out by automated means. It does not automatically cover every inferred score, internal assessment, or data generated independently by the controller, although the exact boundary depends on applicable law and regulatory interpretation. Data portability is distinct from access: access is broader, while portability has stricter conditions and technical-format requirements.

Suitable formats depend on the data. Structured JSON, CSV, XML, or interoperable application interfaces may be appropriate, but format alone does not guarantee usability. The export should include sufficient metadata, preserve meaning, and be securely delivered. Transmission to another controller requires safeguards against misdirected disclosure and should not compromise the rights of others.

8. Withdrawal of consent

Consent must be freely given, specific, informed, and unambiguous where that standard applies. Withdrawal must be as easy as giving consent. A consent-management system should therefore record the purpose, time, method, version of the notice, and scope of consent, and should support withdrawal through an accessible channel.

Withdrawal does not make earlier lawful processing retroactively unlawful. It affects future processing based on consent. After withdrawal, the organisation must stop the relevant processing unless another lawful basis independently applies and the individual has been properly informed. It should not silently replace consent with a different basis simply to defeat the request. Some records may be retained where another legal obligation applies, but optional uses such as promotional profiling should cease.

Consent should not be treated as valid where a service is made unnecessarily conditional on agreeing to unrelated processing, or where the individual lacks a real choice. In employment and public-authority settings, power imbalance may make consent inappropriate as a legal basis.

9. Safeguards against solely automated decisions

Modern privacy regimes commonly provide safeguards where a decision is based solely on automated processing, including profiling, and produces legal effects or similarly significant effects. Examples may include automatic refusal of credit, termination of an essential service, or exclusion from employment consideration, depending on the circumstances and law.

Important safeguards may include:

• prior transparency about the existence and significance of automated decision-making;
• meaningful information about the logic involved, expressed in understandable terms;
• human intervention by a person with authority and competence to review the outcome;
• an opportunity to express a view and contest the decision;
• testing for accuracy, bias, security, and disparate impacts;
• logging of inputs, model versions, outputs, overrides, and review decisions; and
• heightened controls where sensitive or special-category data is involved.

A nominal human click is not meaningful intervention. The reviewer must be able to examine relevant evidence, question the system, depart from its output, and communicate a reasoned decision. Organisations should also distinguish an automated recommendation from a solely automated decision: genuine human assessment may change the legal analysis, but merely approving a system output without scrutiny may not.

Artificial intelligence systems create additional challenges. Data may be inaccurate, training data may reproduce historical discrimination, and explanations may be difficult where complex models are used. Privacy compliance does not replace sectoral equality, consumer-credit, employment, or administrative-law duties. A lawful privacy notice cannot justify an unfair or unsafe decision.

10. Request-management workflow

A rights programme should be designed as a controlled workflow rather than an informal mailbox. A practical sequence is:

1. Receive and capture: Record the request, date, channel, requester, right invoked, and any relevant account identifiers.
2. Acknowledge: Explain the process, likely timing, identity requirements, and contact route.
3. Verify proportionately: Use information already held. Avoid collecting excessive identity documents, and protect copies obtained for verification.
4. Clarify scope: Ask focused questions only where necessary to locate data or understand the request.
5. Identify the controller and legal basis: Confirm responsibility and whether processors or joint controllers are involved.
6. Search and preserve: Locate relevant systems and prevent accidental alteration or deletion during review.
7. Assess exceptions: Consider third-party data, privilege, legal retention, security, confidential investigations, and other lawful limitations.
8. Apply the request: Correct, restrict, delete, export, suppress, or review the decision as required.
9. Quality-check: Confirm that linked systems, processors, recipients, backups, and access permissions have been considered.
10. Respond clearly: State what was done, what was withheld and why, relevant time limits, and complaint or appeal routes.
11. Close and learn: Retain an audit record, measure performance, and identify recurring data-quality or design failures.

The organisation should maintain an escalation route for complex requests, vulnerable individuals, suspected abuse of process, and requests involving children or sensitive data. Staff must understand that the absence of a formal form does not necessarily invalidate a request.

Applied case: the ClearPath lending platform

Background

ClearPath Finance operates an online lending platform. Applicants submit identity, income, and transaction information. A machine-learning system produces a risk score and automatically declines some applications. ClearPath also uses customer information for marketing and retains transaction records to satisfy financial regulations.

Problem

A customer, Maya, sends one email asking for all information held about her, correction of an inaccurate employer name, deletion of her data, an explanation of the automated refusal, withdrawal from marketing, and transfer of her information to another lender.

Analysis

The email contains several rights requests. ClearPath must first verify Maya’s identity proportionately. It should search application files, communications, risk-system records, marketing systems, and relevant processor systems. The inaccurate employer name should be corrected or marked as disputed after evidence is assessed.

Deletion cannot be granted in full if financial regulations require retention of transaction and lending records. However, optional marketing processing should stop following withdrawal or objection, and data not needed for regulatory or legal purposes should be deleted where the applicable law requires it.

The access response should provide Maya’s personal data and relevant supplementary information, while protecting the personal data of employees or other applicants. Portability may apply to data provided by Maya and processed automatically on a qualifying legal basis; an internal risk inference may not automatically fall within the portable set.

Because the refusal was generated without meaningful human assessment and had a significant effect, ClearPath should provide the legally required safeguards. A trained reviewer should examine the application, relevant data, model output, and any evidence supplied by Maya, then make an independent decision. ClearPath should explain the principal factors in understandable language without disclosing security-sensitive model details or another person’s information.

Approach and outcome

ClearPath appoints a case owner, records all requested rights, verifies Maya through her secure account, and issues a response within the applicable statutory period. It corrects the employer field, provides an export of qualifying data, suppresses marketing, retains legally required records under a restricted retention category, and conducts human review of the lending decision. The review identifies that an outdated income record contributed to the refusal; the application is reassessed.

Learning points

The case illustrates that one communication may contain multiple rights. Rights must be assessed separately, exemptions must be specific rather than blanket refusals, and automated-decision safeguards require real human authority. It also demonstrates why data quality, retention design, consent management, and AI governance must operate together.

Challenges, ethics, and governance

The most common operational problems are fragmented systems, unclear ownership, weak identity verification, inconsistent deadlines, inaccessible interfaces, and over-reliance on manual searching. Organisations should measure not only response speed but also completeness, accuracy, correction propagation, exemption quality, and complaint outcomes.

Ethically, rights management should account for power imbalance and accessibility. A person should not be forced to use a complex portal, provide unnecessary identity documents, or understand technical terminology. Alternative formats and reasonable assistance may be necessary. Children and vulnerable persons may require special safeguards, and representatives should be authorised carefully.

Governance should assign responsibility to a privacy or data-protection function, supported by information security, records management, legal, customer operations, and technology teams. Access-request logs should themselves be protected because they may reveal sensitive facts. Training should include realistic exercises involving mixed requests, third-party data, automated decisions, and conflicting retention duties.

Best-practice checklist

• Publish clear instructions for exercising rights.
• Accept requests through more than one accessible channel.
• Maintain a central register and assign an accountable case owner.
• Use proportionate identity verification.
• Track statutory deadlines automatically.
• Map personal-data repositories and processor dependencies.
• Separate data that can be disclosed from data requiring lawful redaction.
• Document reasons for refusals, extensions, and exemptions.
• Propagate corrections, restrictions, and deletions where required.
• Make consent withdrawal as easy as consent.
• Test human intervention in automated decisions.
• Secure exports and verify recipient details before transmission.
• Audit outcomes for consistency, accessibility, and bias.
• Provide complaint and supervisory-authority information where applicable.

Chapter Summary

Individual rights transform privacy from an organisational promise into an enforceable relationship. Access promotes transparency; correction promotes data quality; deletion limits unnecessary retention; objection challenges specified processing; restriction temporarily limits use; portability supports control and switching; consent withdrawal stops future consent-based processing; and safeguards against solely automated decisions protect individuals from consequential opaque outcomes. None of these rights should be handled in isolation. Effective compliance requires identity verification, system searching, exception analysis, secure communication, processor coordination, deadline management, and auditable decisions. Rights may be limited by law, but limitations must be specific, proportionate, and explained. A mature organisation treats requests as evidence about the quality, fairness, and governance of its entire data environment.

Key Terms

Data subject: An identifiable individual to whom personal data relates.

Controller: The organisation that determines the purposes and means of processing.

Processor: An organisation that processes personal data for a controller.

Right of access: The right to obtain confirmation, personal data, and prescribed processing information.

Rectification: Correction or completion of inaccurate or incomplete personal data.

Erasure: Deletion of personal data where a legal ground for removal applies.

Objection: A challenge to specified processing based on the individual’s circumstances or direct marketing rules.

Restriction: Limitation of processing while data may remain stored.

Portability: Receipt or transmission of qualifying personal data in a structured, machine-readable form.

Consent withdrawal: Removal of permission for future processing based on consent.

Profiling: Automated processing used to evaluate or predict aspects of an individual.

Solely automated decision: A decision made without meaningful human involvement.

Human intervention: Genuine review by an authorised and competent person.

Identity verification: Proportionate confirmation of the requester’s identity.

Third-party rights: Privacy and other interests of people whose data appears in requested material.

Legal privilege: Protection for certain confidential lawyer-client communications and legal materials.

Retention schedule: A rule specifying how long categories of records are kept and why.

Data minimisation: Limiting personal data to what is necessary for the purpose.

Accountability: The duty to comply and demonstrate compliance.

Processor coordination: Management of rights-related actions across outsourced service providers.

Review Questions

Short Answer Questions

1. What is the principal difference between the right of access and the right of portability?
2. Why is identity verification required before disclosing personal data?
3. Give two circumstances in which erasure may be limited.
4. What does restriction of processing mean in practice?
5. Why is a nominal human approval insufficient for an automated decision safeguard?

Long Answer Questions

1. Explain the principal individual rights discussed in this chapter and the circumstances in which each may be limited.
2. Describe a complete organisational workflow for receiving and responding to a rights request.
3. Discuss the relationship between consent withdrawal, objection, and direct marketing suppression.
4. Analyse the legal and operational challenges of fulfilling an access request involving multiple processors and third-party information.
5. Explain how an organisation can govern automated decision-making while preserving security-sensitive information about its models.

Analytical / Application Questions

1. An employee requests access, correction, deletion, and restriction of a personnel file while a disciplinary investigation is active. Design a proportionate response, identifying information that may be withheld and information that should still be provided.
2. A customer withdraws consent to personalised advertising but asks the company to delete all records, while tax law requires retention of invoices. Separate the actions the company should take and justify each one.
3. A credit applicant is rejected by an automated system. The company claims that a manager reviews every output, but managers rarely examine the underlying data. Assess whether the safeguard is meaningful and propose controls for a defensible review process.

Multiple Choice Questions with Answers

Question 1

Which right primarily enables an individual to obtain confirmation of processing and a copy of personal data?

A. Right of access

B. Right to object

C. Right to restriction

D. Right to portability

Correct Answer: A. Right of access

Question 2

Which statement best describes restriction of processing?

A. Permanent destruction of every copy of personal data

B. Limiting use of data while it may remain stored

C. Transferring all data to another controller

D. Replacing consent with legitimate interests

Correct Answer: B. Limiting use of data while it may remain stored

Question 3

A customer objects specifically to direct marketing. What is the usual operational response where the applicable law provides an absolute marketing objection?

A. Continue marketing until the next annual review

B. Stop the relevant direct marketing

C. Delete all legally required records

D. Require the customer to explain personal circumstances

Correct Answer: B. Stop the relevant direct marketing

Question 4

Which condition is commonly associated with data portability?

A. The data must always be an internal prediction

B. Processing is commonly based on consent or contract and carried out automatically

C. The organisation must destroy its source records immediately

D. Portability applies only to paper files

Correct Answer: B. Processing is commonly based on consent or contract and carried out automatically

Question 5

What is the correct effect of withdrawing consent?

A. All earlier processing automatically becomes unlawful

B. Future processing based on that consent should stop, subject to other lawful duties

C. The organisation may ignore the withdrawal if data is valuable

D. Every record must be deleted regardless of retention law

Correct Answer: B. Future processing based on that consent should stop, subject to other lawful duties

Question 6

Which feature is essential to meaningful human intervention in an automated decision?

A. The reviewer must always approve the system output

B. The reviewer must be able to examine the case and depart from the output

C. The reviewer must be the software developer

D. The review must occur without access to relevant evidence

Correct Answer: B. The reviewer must be able to examine the case and depart from the output

Question 7

Why might an organisation retain some information after receiving an erasure request?

A. Because erasure rights never exist

B. Because a legal retention obligation may apply

C. Because marketing preferences cannot be changed

D. Because backups are always exempt from every privacy rule

Correct Answer: B. Because a legal retention obligation may apply

Question 8

What should an organisation do when an access request contains personal data about another person?

A. Automatically disclose all information

B. Consider the other person’s rights and redact or withhold where legally necessary

C. Reject the entire request without assessment

D. Publish the information publicly

Correct Answer: B. Consider the other person’s rights and redact or withhold where legally necessary

Question 9

Which practice best supports accountability in rights management?

A. Relying on undocumented staff judgment

B. Maintaining an auditable record of searches, decisions, and communications

C. Accepting requests only through one inaccessible channel

D. Deleting the request log after responding

Correct Answer: B. Maintaining an auditable record of searches, decisions, and communications

Question 10

An individual disputes an opinion recorded in a case file. What is generally the most appropriate approach?

A. Rewrite the historical opinion as fact

B. Preserve a properly identified opinion and record the individual’s response where appropriate

C. Delete the entire case file automatically

D. Ignore the dispute because opinions can never be reviewed

Correct Answer: B. Preserve a properly identified opinion and record the individual’s response where appropriate