Also known as: DSAR · subject access request · privacy rights
Data subject rights are the legal entitlements individuals hold over their personal data, typically including the rights to access, correct, delete, port, and object to the processing of information held about them.
A data subject access request obliges an organisation to disclose what personal data it holds, why, who it has been shared with, and how long it will be retained — usually within a statutory deadline of around 30 days.
Fulfilling these requests reliably is an architectural problem rather than a legal one. Organisations that spread personal data across many systems without a coherent index find that answering 'what do you hold about me?' requires manual archaeology every time.
GDPR
The GDPR (General Data Protection Regulation) is the European Union's data protection law, which governs how personal data of people in the EU may be collected and processed, and grants individuals rights over their data regardless of where the processing organisation is based.
CCPA / CPRA
The CCPA, as amended by the CPRA, is California's consumer privacy law, granting residents rights to know what personal information businesses collect about them, to delete it, to correct it, and to opt out of its sale or sharing.
Right to Erasure
The right to erasure, commonly called the right to be forgotten, allows individuals to request deletion of their personal data in defined circumstances, such as when it is no longer necessary for the purpose it was collected for or consent has been withdrawn.
Data Minimization
Data minimisation is the principle that an organisation should collect and retain only the personal data actually necessary for a stated purpose, and no more, for no longer than needed.
Data Protection Impact Assessment
A data protection impact assessment (DPIA) is a structured evaluation of the privacy risks a proposed processing activity poses to individuals, together with the measures planned to mitigate them.