What is Data subject rights?

Data subject rights are the rights every person has over their own personal data under GDPR. The term "data subject" sounds bureaucratic, but it simply means a person whose data is held in a register — your customer, your employee, or a visitor to your website. Think of the data as their property that you are only borrowing. The owner has the right to ask what you are doing with it and to request it back.

The rights are set out in GDPR Articles 15 to 22 and include the right to know what data you hold (a subject access request), the right to have incorrect data corrected, the right to be erased (sometimes called the right to be forgotten), and the right to move data to another provider. There is also the right to object to certain processing and to request that processing be restricted.

The point is to shift power closer to the individual. Someone who shares their data should feel they still have a say. For your business, that means you must be able to respond when someone exercises one of these rights — and do so within a reasonable time, usually one month.

Why are data subject rights important for your business?

Being able to handle these requests quickly and correctly is both a legal requirement and a trust issue. Mishandling a subject access request or ignoring an erasure request can lead to a complaint to the supervisory authority, which may result in investigation and fines.

It is also about practical order. If you do not know where all the data lives, every request becomes a headache. If you know where the data sits, it becomes a simple routine instead.

Data subject rights in practice

Say a customer emails your online shop and wants all the data you have stored about them. That is the right of access under Article 15. You gather name, order history, and any emails, and send it over clearly within one month, without charging for it.

At ZORC, we build in features to export and delete user data directly in the system, so you can fulfil requests in a few clicks instead of hours of searching.