Your six GDPR rights, summarised
- Article 15 — Access: confirm what they hold and get a copy.
- Article 16 — Rectification: have inaccurate data corrected.
- Article 17 — Erasure (“right to be forgotten”): ask for your data to be deleted.
- Article 18 — Restriction: pause processing while you contest accuracy or grounds.
- Article 20 — Portability: receive your data in a machine-readable format you can give to another service.
- Article 21 — Objection: object to processing — including an absolute right to opt out of direct marketing.
The one-month clock
Article 12(3) gives the recipient one calendar month from receipt to respond. They can extend by two more months for complex requests but only if they notify you within the first month with reasons. After the deadline, you can complain to your national supervisory authority (the ICO in the UK, the CNIL in France, etc.) — and they do take complaints seriously.
Identity verification
Companies sometimes ask for ID before responding. The GDPR allows this only when strictly necessaryto verify you. Giving them your customer email, account number, or order ID usually identifies you well enough. Refuse blanket requests for passport scans unless they genuinely can’t identify you any other way.
Where to send it
Most companies publish a privacy contact in their privacy policy — usually privacy@company.com or a DPO (Data Protection Officer) at dpo@company.com. Email is fine and creates a timestamped record. Keep a copy of what you sent.