According to the GDPR, individuals have the rights to the following:
THE RIGHT TO BE INFORMED
When collecting a client’s personal data, an association is required to provide them with the reason for collecting their data, the holding time for the data as well as who it will be shared with.
THE RIGHT OF ACCESS
Clients have the right to access their personal information. They can request the access either verbally or via a written request. Associations have one month to reply to the request and are not permitted to charge their clients for dealing with the request.
THE RIGHT TO RECTIFICATION
A client can correct incorrect or incomplete data under the GDPR. The same request rights or rules apply as to the right of access, although, in some situations, the correction may be declined.
THE RIGHT TO ERASURE
The GDPR also states that a client may erase their personal information. They can request this in writing or verbally. The association / company has one month to reply. This does not apply in all situations but only relates to some situations. The GDPR has other ways of enforcing the deletion of personal information.
THE RIGHT TO RESTRICT PROCESSING
Clients may request restriction or suppression of personal information, but the right is not total and only relates to some situations. In the event of restrictions, associations can store the data but cannot use it. Again, the same rights or rules of requesting applies.
THE RIGHT TO DATA PORTABILITY
This allows clients to obtain their information, duplicate, transfer or change for their data according to their own purposes, without upsetting the usability. Yet, this only applies to the data given to a controller.
THE RIGHT TO OBJECT
Clients have the right to object to the processing of their information under the GDPR. This right is absolute; although, in some situations, it is not. If an association can provide the compelling reason behind the processing, they are allowed to continue. Associations are responsible for telling the client of this right.
RIGHTS IN RELATION TO AUTOMATED DECISION-MAKING AND PROFILING
This right allows for decision-making without any human involvement and automated information evaluation. All automated individual decision-making and profiling falls under the GDPR.