GDPR Chapter III, Articles 12 to 22: the rights systems must support, from request intake, deadlines and identity checks to access exports, rectification, erasure, restriction, portability, objection and automated decisions.
The procedural rules behind every data subject request: the one-month deadline and extensions, electronic replies, identity verification, free-of-charge handling and refusals. The process backbone that request-handling workflows implement.
The privacy notice content required when data are collected from the person (Article 13) or obtained elsewhere (Article 14), the timing rules, and keeping notices consistent with records of processing and actual system behavior.
Confirmation, a copy of the data and supporting information: what an access response must contain, how to find data across IT and paper systems, secure delivery, and identity checks proportionate to the data.
Correcting inaccurate personal data and completing incomplete data without undue delay, including by supplementary statement, and propagating corrections to recipients under Article 19.
When personal data must be erased without undue delay, the exceptions, informing other controllers about published data, and the hard parts in systems: backups, replicas, logs and anonymization used in place of deletion.
Marking and freezing personal data so it is only stored, not otherwise used, while accuracy or an objection is checked or when the person needs it for legal claims, and notifying the person before lifting the restriction.
Propagating corrections, deletions and restrictions to every recipient that received the data, and telling the data subject who those recipients are on request. Depends on knowing where data flows.
Exporting data the person provided in a structured, commonly used, machine-readable format and transmitting it directly to another controller where technically feasible; scope limits and which data count as provided.
Stopping processing based on public task or legitimate interests unless compelling grounds exist, the absolute right to object to direct marketing, and objection by automated means for online services.
The right not to be subject to solely automated decisions with legal or similarly significant effects, the three exceptions, the human-intervention safeguards, and what meaningful human involvement means for scoring and AI systems.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.