Under the General Data Protection Regulation (GDPR), data subjects have several rights that empower them to have control over their personal data and how it is processed by organizations. These rights are designed to enhance privacy and data protection for individuals. Here are the key data subject rights under the GDPR:

1. Right to Information and Transparency: Data subjects have the right to be informed about the collection, processing, and use of their personal data. Organizations must provide clear and concise information about their data processing activities, including the purposes, legal basis, retention periods, and recipients of the data.

2. Right of Access: Data subjects have the right to obtain confirmation from the data controller as to whether or not their personal data is being processed, and if so, they can request access to that data. The organization must provide a copy of the personal data along with additional information, such as the categories of data processed and the recipients of the data.

3. Right to Rectification: Data subjects can request the correction of inaccurate or incomplete personal data held by an organization. The data controller must promptly rectify any inaccuracies and communicate the changes to other recipients, if applicable.

4. Right to Erasure (Right to be Forgotten): Data subjects have the right to request the erasure of their personal data under certain circumstances, such as when the data is no longer necessary for the purposes it was collected or processed, or when the data subject withdraws consent. However, this right is not absolute and may be limited by other legal obligations.

5. Right to Restriction of Processing: Data subjects can request the restriction of processing of their personal data in certain situations, such as when they contest the accuracy of the data or when the processing is unlawful, and the data subject opposes erasure.

6. Right to Data Portability: Data subjects have the right to receive their personal data in a structured, commonly used, and machine-readable format. They can also request the transfer of their data to another data controller when the processing is based on consent or a contract.

7. Right to Object: Data subjects can object to the processing of their personal data based on legitimate interests or for direct marketing purposes. In such cases, the organization must stop processing the data unless they have compelling legitimate grounds for the processing that override the interests, rights, and freedoms of the data subject.

8. Rights Related to Automated Decision Making and Profiling: Data subjects have the right not to be subject to decisions based solely on automated processing, including profiling, which produce legal effects or significantly affect them. There are exceptions if the decision is necessary for the performance of a contract or is based on explicit consent.

To exercise these rights, data subjects can usually submit a request to the data controller (the organization collecting the data) through a designated contact or privacy email address. Organizations are required to respond to these requests without undue delay and generally within one month of receipt of the request, although this can be extended under certain circumstances.

The GDPR places a strong emphasis on accountability, transparency, and the protection of individuals' rights concerning their personal data. Non-compliance with these data subject rights can lead to severe penalties for organizations, including fines of up to 4% of their global annual revenue or €20 million, whichever is higher.
spam fails_task lang_mismatch pii not_appropriate hate_speech sexual_content quality toxicity humor helpfulness creativity violence