Under GDPR Article 15, a data subject has the right to:
- A.Demand deletion of all data held by any organization, under Article 16's right to rectification, which allows the data subject to require the controller to delete records instead of correcting them
- B.Override any processing carried out by the controller
- C.Sell their personal data to third parties, and the Act needs a notarised form
- D.Obtain confirmation of whether their data is being processed and access to it
Why D is correct
Article 15 grants data subjects the right to obtain confirmation of whether their personal data is being processed and, if so, to access it along with supplementary information.
Know someone studying for GDPR? Send them this one.