Accommodating data subjects’ rights

Accommodating data subjects’ rights can be one of most nuanced and challenging areas of GDPR implementation. Indeed, as the IAPP-EY Annual Privacy Governance Report 2017 demonstrated, data portability, the right to be forgotten, and gathering explicit consent are perceived as the most difficult issues for privacy professionals.

One suggested way of tackling these issues is not to consider them as separate workstreams, but to think of them as the same question asked in different ways. Generally speaking, data subjects can request access to a copy of their personal data and to a variety of other information, such as the purpose of processing, categories of data that are processed, information on the parties to which their personal data have been disclosed (specifically, recipients in third countries), and retention periods.

Source: Top 10 Operational Responses to the GDPR – Part 7: Accommodating data subjects’ rights