{"id":74935,"date":"2019-08-06T05:49:36","date_gmt":"2019-08-06T12:49:36","guid":{"rendered":"https:\/\/www.questionpro.com\/blog\/?p=74935"},"modified":"2026-08-19T00:43:03","modified_gmt":"2026-08-19T07:43:03","slug":"gdpr-rights","status":"publish","type":"post","link":"https:\/\/www.questionpro.com\/blog\/gdpr-rights\/","title":{"rendered":"GDPR Data Subject Rights: What Every Data Controller Must Know"},"content":{"rendered":"\n

GDPR data subject rights give individuals in the European Union control over the personal information that businesses collect and hold on them. Since May 2018, the General Data Protection Regulation has required every data controller, meaning any organization that decides why and how personal data gets processed, to honor these rights on request.<\/p>\n\n\n\n

For US companies running surveys, market research, or customer feedback programs that reach EU respondents, this is not optional. Enforcement keeps growing sharper. Cumulative GDPR fines have passed \u20ac7.1 billion since 2018<\/a>, with roughly \u20ac1.2 billion issued in 2025 alone.<\/p>\n\n\n\n

This guide breaks down each of the eight rights, what controllers must do to respond, and how these obligations shape the way you collect survey and research data today.<\/p>\n\n\n\n\n\n

What is a data subject under GDPR?<\/strong><\/h2>\n\n\n\n

A data subject is any identifiable person whose personal data is collected, stored, or processed by an organization. This covers customers, survey respondents, employees, and website visitors located in the EU.<\/p>\n\n\n\n

It helps to separate the three roles GDPR defines. The data subject is the individual the data belongs to. A data controller decides why and how that data gets processed, while a data processor is a third party, such as a survey platform or cloud host, that processes data on the controller’s behalf and under its instructions.<\/p>\n\n\n\n

One company can act as both a controller and a processor depending on the activity. A business surveying its own customers is a controller for that data, while a software vendor hosting those survey responses is typically a processor.<\/p>\n\n\n\n

The 8 GDPR data subject rights at a glance<\/strong><\/h2>\n\n\n\n

GDPR groups individual privacy protections into eight distinct rights, set out in Chapter III of the regulation. Each one gives the data subject a different form of control over their personal data, and each carries its own conditions and exceptions.<\/p>\n\n\n\n

\n \n \n \n \n \n \n \n \n \n \n \n \n
Right<\/th>\n GDPR article<\/th>\n What the data subject can do<\/th>\n <\/tr>\n <\/thead>\n
Right to be informed<\/td>\n 12-14<\/td>\n Know how and why their data is used<\/td>\n <\/tr>\n
Right of access<\/td>\n 15<\/td>\n Request a copy of their processed data<\/td>\n <\/tr>\n
Right to rectification<\/td>\n 16<\/td>\n Correct inaccurate or incomplete data<\/td>\n <\/tr>\n
Right to erasure<\/td>\n 17<\/td>\n Ask for their data to be deleted<\/td>\n <\/tr>\n
Right to restrict processing<\/td>\n 18<\/td>\n Pause processing without deleting the data<\/td>\n <\/tr>\n
Right to data portability<\/td>\n 20<\/td>\n Receive their data and move it elsewhere<\/td>\n <\/tr>\n
Right to object<\/td>\n 21<\/td>\n Stop processing for specific purposes<\/td>\n <\/tr>\n
Rights related to automated decisions<\/td>\n 22<\/td>\n Avoid solely automated decisions with legal effect<\/td>\n <\/tr>\n <\/tbody>\n <\/table>\n<\/div>\n\n\n\n

The European Data Protection Board<\/a> treats these eight rights as the practical core of what transparent, compliant data handling requires from any organization operating in the EU.<\/p>\n\n\n\n

Right to be informed<\/strong><\/h2>\n\n\n\n

The right to be informed means data subjects must know, before or at the point of data collection, who is processing their data and why. Every other right depends on people knowing their data is being collected in the first place.<\/p>\n\n\n\n

Under Articles 13 and 14, controllers must disclose:<\/p>\n\n\n\n