Data subject rights

Data subject rights give individuals practical control over their data. The GDPR (Arts. 12-22) provides the rights to be informed, of access, rectification, erasure, restriction of processing, data portability, objection and not to be subject to solely automated decisions with legal or similarly significant effects. Controllers must respond without undue delay, generally within one month, free of charge, after verifying identity proportionately. Some rights depend on the lawful basis: portability applies to consent and contract, objection mainly to legitimate interest and public task.

The LGPD (Art. 18) lists similar rights, including confirmation of processing, anonymization, blocking or deletion of unnecessary data, information about sharing and about the possibility of refusing consent, and review of automated decisions (Art. 20).

AI complicates fulfilment. Finding a person's data in training sets, logs and vector stores requires good mapping, and erasing data already learned by a model may require retraining or other technical measures. Organisations should design these processes before launch, not after the first request.