Rights to Be Informed, Access, and Rectification

The right to be informed requires controllers to provide processing information when they collect data - a Privacy notice. Where data is not collected directly from the subject, they must also be told details such as the source. Notice forms include a layered approach, just-in-time notices, and privacy dashboards.

The right of access lets data subjects obtain confirmation of processing, a copy of their data, and information that should already be in a privacy notice. This is the Subject access request, and it is often the gateway to exercising other rights because it reveals the what, why, and how of processing.

The Right to rectification supplements the accuracy principle, letting data subjects have inaccurate data corrected and incomplete data completed (via a supplementary statement).