4.2Individual rights & consent
The essentials in 30 seconds
- Rights, not favours: access, rectification, erasure, objection, portability, restriction.
- Demanding consent: freely given, informed, specific, unambiguous — never pre-ticked, always withdrawable.
- Forward, do not improvise: every request goes to the DPO without delay, the clock starts on receipt.
Running mini-case — Karim receives an erasure request
A client writes to Karim: 'delete all my data'. His first instinct would be to erase everything to do the right thing — or to ignore the pressing message. Instead of improvising, Karim forwards the request to the data contact the same day with the date of receipt, and replies to the client that the request is being handled. The contact will decide what must truly be erased and what must be kept.
Sequel to case 4.1 — Karim moves from spotting data to the right reflex on rights.
1. Enforceable rights
The regulation gives each person rights: access ('what do you hold on me?'), rectification, erasure ('right to be forgotten'), portability, objection, restriction. These are rights, not favours: any organisation must be able to respond, generally within one month.
2. Consent, one basis among others
Consent must be freely given, informed, specific and unambiguous — a pre-ticked box is not enough, and it can be withdrawn as easily as it was given. Cookie banners are its most visible application.
But consent is only one legal basis among six (contract, legal obligation, legitimate interest…): many everyday processing activities rely on contract or law, not on consent. Hence the importance of letting the contact assess each case.
3. Forward, do not improvise
A rights request is forwarded to the DPO/contact without delay: the response time runs from receipt, every lost day counts. Karim forwards it the same day, with the facts (who, when, what).
Faced with an erasure request, never improvise: some data must be kept (invoicing, warranty), other data erased. Erasing everything — or refusing everything — would be a mistake in both directions.
🔎 Concrete example — 🔎 Concrete example — Experiencing rights from both sides
Karim understands rights by practising them from both sides:
As an individual: Karim exercises his right of access ('download my data')
→ discovers what is actually collected about him
As an employee: 'delete my data' received → forwarded to the DPO the same day
In-house form checked: information present? pre-ticked boxes (forbidden)?
→ the right reflex: forward, never improviseReading: exercising a right yourself makes you understand others'.
Lesson: the clock starts on receipt — date every request.
Section vocabulary
- Individual rights
- Access, rectification, erasure, objection, portability, restriction: anyone can exercise them on THEIR data.
Simple example: Karim's client requests erasure; a colleague could request rectification of wrong data.
What it is not: favours granted at the company's discretion.
Reflex: receiving a request = date it and forward it.
- Right of access
- 'What data do you hold on me?': the organisation must reply, generally within one month.
Simple example: Karim tries the 'download my data' feature of a service he uses to see what is collected.
What it is not: an approximate summary given orally months later.
Reflex: direct people to the official channel, never answer from memory.
- Consent
- One of the legal bases: freely given, specific, informed, unambiguous — and withdrawable as easily as it was given.
Simple example: Karim checks a form: no pre-ticked box, an explicit yes for each use.
What it is not: a pre-ticked box or consent forced to access the service.
Reflex: look for the pre-ticked box: if there is one, flag it.
- Legal bases
- Consent is only one basis among six (contract, legal obligation, legitimate interest…): all processing must rely on one of them.
Simple example: Karim's client's invoices are kept under a legal obligation even if erasure is requested.
What it is not: believing everything rests on consent and erasing everything on request.
Reflex: let the contact assess the basis before any action.
- Information (transparency)
- People must know who collects what, why, for how long: information notices, privacy policies.
Simple example: Karim checks that the in-house form shows purpose, retention and rights before signing.
What it is not: collecting data without saying anything about its use or retention.
Reflex: read an information notice in full once, to know what one looks like.
In practice — In practice — Experiencing rights from both sides
- As an individual: exercise your right of access with a service you use (privacy section → 'download my data') — instructive about what is actually collected.
- As an employee: if a client asked you 'delete my data', would you know what to do? Identify the internal channel (generally: forward to the DPO, never improvise).
- Check one of your organisation's forms: is the information present (purpose, rights)? Are consent boxes pre-ticked (forbidden)?
- Note the deadline rule: a rights request received = forwarded immediately — the clock starts on receipt.
Ready-to-say script — acknowledging a request (20 s)
'I have received your request about your data, dated today, and I am immediately forwarding it to our dedicated contact, who will reply within the applicable time limits. Can you confirm your identity so the file is complete?'
Say or write without promising erasure or a precise deadline; forward to the DPO the same day.
Copy-paste template — request forwarding sheet
REQUEST RECEIVED ON: _______________ (channel: email / letter / oral)
REQUESTER (identity verified?): _______________
RIGHT EXERCISED (access / erasure / rectification / objection…): _______________
DATA / FILES CONCERNED: _______________
FORWARDED TO DPO / CONTACT ON: _______________
REPLY TO REQUESTER (acknowledged on): _______________Oral request at the counter
Restate it in writing, date it and forward it the same way: oral does not exempt you from recording or forwarding.
Aggressive or pressing request
Stay courteous, acknowledge receipt, forward: pressure changes neither the channel nor the deadline, it makes it more urgent.
Doubtful form
Pre-ticked boxes or missing information: photograph and flag to the contact instead of 'fixing' it yourself.
Showcase website cookies
Check that refusing is as easy as accepting: the banner is the company's most visible consent.
✓ Best practices
- Every request dated and forwarded without delay.
- Forms: informed, never pre-ticked.
- Consent is not always the basis.
✗ Common pitfalls
- Improvising an erasure reply.
- Pre-ticked consent boxes.
- Letting the deadline slip without forwarding.
Key takeaways
- Anyone can request access, correction or erasure of their data: these are rights, not favours.
- A rights request is forwarded to the DPO/contact without delay — the response time runs from receipt.
- Consent must be freely given and explicit: pre-ticked boxes and forced consent are unlawful.
- Consent is not always the right basis: contract and legal obligation cover many everyday processing activities.
48h challenge — apply tomorrow
Identify in writing the internal channel for a rights request (who, which address, which internal deadline) and check 1 in-house form (information + non-pre-ticked boxes).
- I can cite the 6 individual rights.
- I know why we forward instead of improvising.
- I have identified the internal channel and checked 1 form.
Frequently asked questions
An unhappy client demands deletion of all their data: must we erase everything?
Not necessarily: data needed for a legal obligation (invoicing, warranty) is kept. That is precisely why the request is forwarded to the DPO, who decides legal basis by legal basis.
What do we risk by ignoring an access request?
Complaint, formal notice, fine — and a damaged image. Breach of rights is one of the first grounds for complaints to supervisory authorities.
Karim receives 'delete my data'. What must he do?