Your rights
Access, deletion, objection, complaint — the 8 GDPR rights + how to exercise them.
- Right of accessEvery business, government or organisation that processes your personal data must provide a copy within 1 month — free, on request. That's your right of access.Live
- Right to erasureIn specific cases a business must erase your data within 1 month — e.g. after withdrawal of consent, expiry of purpose, or unlawful processing.Live
- Right to objectFor processing based on "legitimate interest" or direct marketing you may object. For direct marketing it's absolute — they must stop.Live
- Complaint to the APHas a business violated your GDPR rights or failed to respond? You can complain free of charge to the Autoriteit Persoonsgegevens — in writing or via their online complaint form.Live
- Right to rectificationCompanies must correct inaccurate or incomplete data about you within 1 month — free of charge, on your request (GDPR Art. 16).Live
- Right to restrictionThe right to restriction lets you temporarily "freeze" processing — storing is OK, using is not. Useful while a dispute is pending.Live
- Right to portabilityReceive your data in a structured, machine-readable format — to switch to another provider or keep it yourself (GDPR Art. 20).Live
- No automated decisionsDecisions made solely by an algorithm that significantly affect you can be reviewed by a human (GDPR Art. 22).Live
- Right to explanationFor algorithmic decisions you have a right to meaningful explanation of the underlying logic — not just "the algorithm decided so".Live
- Right to compensationFor a GDPR violation you can claim material AND non-material damages — no threshold amount, no "serious harm" required since CJEU rulings 2023-2024.Live
- Withdraw consentWithdrawing consent must be as easy as giving it. No "are you sure?" pop-ups, no hidden opt-outs, no fees.Live
- Object to marketingObjection to direct marketing is absolute: once you object, they may never contact you again for marketing — no "are you sure", no fees.Live