EUGDPRData Subject RightsEASYFree question
The right to be informed requires controllers to provide data subjects with:
- A.Information about the processing of their data, including purposes and legal basis
- B.Technical specifications of the controller's IT systems, under Article 30(1), which excuses controllers with fewer than 500 employees from keeping any records of processing
- C.Access to the controller's financial records, under Article 18's right to restriction, which requires the controller to permanently delete the data rather than merely limit its processing
- D.The names and salaries of all employees
Why A is correct
Articles 13 and 14 require controllers to provide data subjects with comprehensive information about processing, including the controller's identity, purposes, legal basis, recipients, and retention periods.
Know someone studying for GDPR? Send them this one.