Data Subject Rights Exercise Modalities and Procedures

Legal Framework

Articles 12 through 15 GDPR form the procedural backbone for data subject rights exercise. Article 12(1) mandates that controllers facilitate rights exercise through transparent, easily accessible, and intelligible means, using clear and plain language. Article 12(2) requires controllers to provide information on action taken without undue delay and within one month of receipt, extendable by two further months where necessary given complexity or volume. Article 12(3) obliges controllers to justify any non-action, informing the data subject of the reasons and the availability of a complaint or judicial remedy. Articles 15 through 22 define the substantive rights themselves—access, rectification, erasure, restriction, portability, and objection—but their practical operability depends entirely on the Article 12 modalities. The rationale is structural: rights without accessible, procedurally sound mechanisms are effectively illusory.

Key Developments

The CJEU's ruling in Minister voor Immigrratie v. M (Case C-553/13) established that compliance with the right of access does not require furnishing a literal copy of documents; providing a full summary in an intelligible form suffices, provided the data subject can verify accuracy and lawfulness of processing. This sets a practical floor for access responses while emphasizing functional adequacy over formal completeness. The Court also confirmed access as a precondition enabling rectification, erasure, and blocking.

In Jehovah's Witnesses (Case C-25/17), the Court rejected blanket refusals of access premised on third-party privacy concerns, requiring controllers to conduct case-specific balancing rather than invoking privacy categorically.

Enforcement actions reinforce these standards. The Italian Garante fined Green.mec. s.r.l. €1,000 for failing to adequately respond to a former employee's access request, demonstrating that incomplete or evasive responses trigger sanctions even at modest financial thresholds. The Romanian ANSPDCP fined SC Piramida Trade Invest SRL €3,000 for processing without sufficient legal basis, underscoring that lawful basis deficiencies compound procedural failures when rights requests expose underlying compliance gaps.

The EDPB's February 2026 identification of barriers to full erasure implementation signals continued regulatory scrutiny of how controllers operationalize response obligations, particularly where technical or legal obstacles are invoked.

Practical Guidance

• Establish a single, documented intake channel for all rights requests and log receipt dates immediately—the one-month Article 12(2) deadline runs from receipt, not internal routing.
• For access requests, prepare intelligible summaries rather than raw document dumps, consistent with Minister v. M, but ensure summaries are sufficiently detailed for the data subject to verify accuracy and lawfulness.
• Never refuse access categorically on third-party privacy grounds; conduct individualized balancing per Jehovah's Witnesses and document the analysis.
• Implement a two-month extension protocol with documented complexity justifications and notify the data subject within the initial one-month period as required by Article 12(3).
• Train frontline staff to recognize rights requests expressed informally—Article 12 does not require magic words, and misidentification of a request was a factor in the Green.mec. enforcement.