Data Subjects’ Rights Training

What the training consists of

1. 

   1. Introduction to data subjects’ rights

   1:32

   Data subjects’ rights let people know who processes their data, see what is processed and have incorrect data corrected or deleted. The first lesson explains this purpose and lists the rights, which apply to customers, employees and anyone else.

2. 

   2. Data subjects’ rights explained

   2:50

   The second lesson shows the rights in daily work: a customer asking to see their data (a data access request), a record that needs correcting, a newsletter subscriber who withdraws consent and asks to be deleted, and a request for a human review of an automated decision.

3. 

   3. How to respond to data subjects’ rights

   1:28

   In the last lesson, colleagues learn what their own part is. It means knowing the data they handle, acting on a request or an error they notice, passing it to a department such as HR, IT or Compliance where needed, and replying, preferably in writing.

Why it matters

Most roles involve other people’s personal data, so a request about it, or an error in it, can reach people across the organisation. The organisation must then respond as soon as possible, and as a general rule within one month.

What your colleagues learn

• Some rights apply before anyone asks. People must be told early, in clear and simple language, how their data will be used, stored and protected, without having to ask.
• Changes have to reach everyone who received the data. If the data was passed on, for example to an insurer or a public health authority, the organisation must tell them when it is corrected, deleted or its use put on hold.
• An objection can stop the processing. If someone objects, for example to marketing, the organisation must stop processing their data unless it has compelling reasons to continue, such as a legal obligation.
• A request is only fulfilled after an identity check. Checking that the person asking is who they claim to be prevents personal data from being disclosed to the wrong person by accident.
• The rights do not have to be memorised. They can be complex, so when one comes up, colleagues turn to the organisation’s own guidelines or the person responsible for GDPR compliance.