Chapter IIIRights of the data subject

Section 1 – Transparency and modalities

• Article 12Transparent information, communication and modalities for the exercise of the rights of the data subject

  1. The controller shall take appropriate measures to provide any information referred to in Articles 13 and 14 and any communication made under or by virtue of Articles…

• Article 12AMeaning of “applicable time period”

  1. In Article 12 , “the applicable time period” means the period of one month beginning with the relevant time, subject to paragraph 3 . 2. “The relevant…

Section 2 – Information and access to personal data

• Article 13Information to be provided where personal data are collected from the data subject

  1. Where personal data relating to a data subject are collected from the data subject, the controller shall, at the time when personal data are obtained, provide the…

• Article 14Information to be provided where personal data have not been obtained from the data subject

  1. Where personal data have not been obtained from the data subject, the controller shall provide the data subject with the following information: (a) the identity and the…

• Article 15Right of access by the data subject

  1. The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed,…

Section 3 – Rectification and erasure

• Article 16Right to rectification

  The data subject shall have the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her. Taking into account…

• Article 17Right to erasure (‘right to be forgotten’)

  1. The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller…

• Article 18Right to restriction of processing

  1. The data subject shall have the right to obtain from the controller restriction of processing where one of the following applies: (a) the accuracy of the personal…

• Article 19Notification obligation regarding rectification or erasure of personal data or restriction of processing

  The controller shall communicate any rectification or erasure of personal data or restriction of processing carried out in accordance with Article 16 , Article 17(1) and Article 18…

• Article 20Right to data portability

  1. The data subject shall have the right to receive the personal data concerning him or her, which he or she has provided to a controller, in a…

Section 4 – Right to object ...

• Article 21Right to object

  1. The data subject shall have the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning…

• Article 22Automated individual decision-making, including profiling

  . . . . . . . . . . . . . . . . . . . . . . . . . . . .…

Section 4A – Automated individual decision-making

• Article 22AAutomated processing and significant decisions

  1. For the purposes of Articles 22B and 22C — (a) a decision is based solely on automated processing if there is no meaningful human involvement in the…

• Article 22BRestrictions on automated decision-making

  1. A significant decision based entirely or partly on processing described in Article 9(1) (processing of special categories of personal data) may not be taken based solely on…

• Article 22CSafeguards for automated decision-making

  1. Where a significant decision taken by or on behalf of a controller in relation to a data subject is— (a) based entirely or partly on personal data,…

• Article 22DFurther provision about automated decision-making

  1. The Secretary of State may by regulations provide that, for the purposes of Article 22A(1) (a), there is, or is not, to be taken to be meaningful…

Section 5 – Restrictions

• Article 23Restrictions

  1. The Secretary of State may restrict the scope of the obligations and rights arising under or by virtue of Articles 12 to 22D and Article 34 ,…