All GDPR rights on one page (the 8 data-subject rights + complaint right)

GDPR grants you 8 concrete rights + 1 right to complain. Each is exercisable via a written request to the business (email suffices). Default response time 1 month, extendable by 2 months for complexity. (1) Right to information (Art. 13-14) — know in advance what data they process, why, and how long. The privacy statement must disclose this. (2) Right of access (Art. 15) — get a copy of what they hold on you. Read more →. (3) Right to rectification (Art. 16) — have inaccurate data corrected or supplemented. Read more →. (4) Right to erasure (Art. 17) — "right to be forgotten" in 6 specific cases. Read more →. (5) Right to restriction (Art. 18) — temporarily freeze processing. Read more →. (6) Right to portability (Art. 20) — receive data in machine-readable format for switching. Read more →. (7) Right to object (Art. 21) — stop processing; absolute for direct marketing. Read more →. (8) Right regarding automated decision-making (Art. 22) — human review of algorithmic decisions. Read more →. (+1) Right to complain (Art. 77) — complaint to the Dutch DPA. Read more →. Bonus rights: right to AI explanation (Art. 13/15 + Recital 71), right to compensation (Art. 82), right to withdraw consent (Art. 7). Best escalation order: (a) first access → know what they have, (b) then rectification or erasure or objection → the actual action, (c) on refusal or silence after 30 days → AP complaint or civil court. Our GDPR rights pack (€29) bundles the 4 letters needed for this entire cycle.