Your Data Subject Rights
Under GDPR, you have rights to control your personal data. Exercise them here.
Your GDPR Rights Explained
The General Data Protection Regulation (GDPR) gives you six fundamental rights regarding your personal data. We explain each one and help you exercise them.
Right of Access
You have the right to know what personal data organisations hold about you.
Response deadline: 30 days
Also called: "Subject Access Request" (SAR)
You can request a copy of your personal data in an accessible format. This helps you understand what information is held and how it is used.
Submit RequestRight to Rectification
You can correct inaccurate or incomplete personal data about you.
Response deadline: 30 days
Also called: "Correction request"
If your data is incorrect, outdated, or incomplete, you can request correction without undue delay. Organisations must update their records promptly.
Submit RequestRight to Erasure
You can request deletion of your personal data under certain circumstances.
Response deadline: 30 days
Also called: "Right to be forgotten"
In specific situations (data no longer needed, withdrawal of consent, or unlawful processing), you can request erasure. Note: Legitimate interests may prevent deletion.
Submit RequestRight to Restrict Processing
You can limit how organisations process your personal data.
Response deadline: 30 days
Also called: "Right to block"
Instead of deletion, you can request restriction of processing. This is useful when you dispute accuracy or believe processing is unlawful.
Submit RequestRight to Data Portability
You can transfer your personal data to another service provider.
Response deadline: 30 days
Format: Structured, machine-readable format (CSV, JSON, etc.)
You can request your data in a portable format and move it to a competitor. Promotes competition and your control over digital identity.
Submit RequestRight to Object
You can object to processing of your personal data in certain situations.
Response deadline: 30 days
Applies to: Legitimate interests, direct marketing
You can object to processing for legitimate interests or direct marketing purposes. Organisations must stop processing unless they have compelling grounds to continue.
Submit RequestImportant Information
Submit a Data Subject Rights Request
Use this form to exercise any of the six data subject rights under GDPR. We will ensure your request is processed in compliance with Article 12 GDPR.
Data Subject Rights Request Form
Need Help?
If an organisation fails to respond to your request or denies your rights, you can lodge a complaint with the Portuguese supervisory authority.
www.cnpd.pt
You can file a complaint if your rights are violated.
Our DPO services team can help you understand your rights and navigate the process. Get in touch for guidance.