Data Knight handles
- Identify your data online and the organisations concerned.
- Identify contact channels or DPOs.
- Prepare and send authorised requests.
- Organise follow-ups and centralise replies.
- Update statuses and outcomes.
Understand your rights, then act
Your GDPR rights, and how to exercise them in practice
The GDPR gives you practical ways to find out who uses your data, correct it, object to certain uses or request its removal. The first step is choosing the right right and knowing how to use it.
Choose the right right
Start with your situation, not legal jargon
Each right addresses a different need. Conditions depend on the context and why the organisation uses your data, but this overview helps you choose a starting point.
- Savoir
Right of access
Article 15Find out whether an organisation uses your data, receive a copy and understand where it came from, how it is used and how long it is kept.
- Corriger
Right to rectification
Article 16Have inaccurate or incomplete personal information corrected or completed.
- Supprimer
Right to erasure
Article 17Request the deletion of data that is no longer needed, is used unlawfully or relies on consent you have withdrawn.
- Suspendre
Right to restriction
Article 18Ask for the use of your data to be temporarily suspended while a dispute or request is reviewed.
- Retrieve
Right to data portability
Article 20Receive certain data you provided to a service in a machine-readable format, or transfer it to another organisation.
- Refuser
Right to object
Article 21Object to certain uses of your data, including direct marketing, and ask for them to stop.
Exercise a GDPR right in four steps
A useful request identifies the right contact, explains the outcome you want and leaves a dated record. You do not need to write like a lawyer to be understood.
- 01Identify
Find the organisation or its DPO
Look for its privacy, personal data or data protection officer contact section.
- 02Choose
Use the appropriate right
Explain what you want to know, correct, suspend, receive, object to or delete. This helps you exercise your rights effectively.
- 03Send
Make a clear request
Send your request to the appropriate team, identifying the data concerned and the outcome you want.
- 04Keep
Keep proof of your request
Save your message, acknowledgement or a screenshot of the form so you can track the deadline and prepare a complaint if needed.
Before sending
Practical rights, with a few rules to know
The GDPR makes action easier, but does not make every request automatic. A proper response must consider your identity, the context, the legal basis and other people's rights.
Usually free of charge
Exercising a right should generally be free. Manifestly unfounded or excessive requests may, however, be refused or incur a justified fee.
Proportionate identity checks
An identity document is not automatically required. The organisation may request appropriate evidence if it has reasonable doubts.
A sufficiently precise request
Identifying the account, service, data or content concerned helps the organisation understand and handle your request.
Erasure has limits
Some data may still be needed for a legal obligation, freedom of expression, legal claims or a task in the public interest.
If there is a refusal or no reply
The response deadline is part of your rights
No reply does not mean the process is over. Keep evidence, distinguish an announced extension from silence and document every exchange.
- 1
Check the first-month deadline
The organisation must respond within one month or notify you within that month of a justified extension, bringing the total to up to three months.
- 2
Follow up and request an explanation
If the response is incomplete or your request is refused, contact the organisation or its DPO and ask for the reasons and available remedies.
- 3
Complain to the CNIL
If you still receive no satisfactory response, include your initial request, proof of sending and any replies with your complaint.
With Data Knight
We handle the requests. You make the decisions
Data Knight uses these rights to turn separate searches, forms and follow-ups into a tracked process. Every action stays visible, and the scope depends on what you chose and authorised.
You keep control of
- The traces you want to remove.
- The scope of your authorisation to Data Knight.
- Supporting documents or confirmations that are actually needed.
- Decisions to make after a response or refusal.
Frequently asked questions
See all FAQsUseful answers before taking action
What are the main rights under the GDPR?
The GDPR includes the rights to be informed, access, rectification, erasure, restriction, portability, objection and human intervention in certain fully automated decisions. The applicable right depends on the situation and the legal basis used by the organisation.
How do I exercise a GDPR right?
Contact the organisation using your data or its data protection officer. Clearly state who you are, the right you want to exercise, the data or service concerned and the outcome you want. Use an official form or dedicated address where possible, and keep a dated copy of your request.
How long does an organisation have to respond?
It must respond without undue delay and, in principle, within one month. It may extend this period by two months if the request is complex or requests are numerous, but it must explain the extension and its reason within the first month.
Do I have to send an ID document?
Not automatically. The organisation may ask for additional information if it has reasonable doubts about your identity. Verification must remain proportionate to the request and data concerned. A copy of your ID should not be required by default when your identity is already sufficiently established.
Does the right to erasure always require my data to be deleted?
No. The right to erasure applies under certain conditions and has exceptions, for example where retention is necessary to meet a legal obligation, exercise freedom of expression or defend a legal claim. A refusal must be explained and can be challenged.
What can I do if the organisation does not respond or refuses my request?
Keep evidence of your request and check whether an extension has been announced. You can follow up with the organisation or its DPO. If there is still no response or it remains unsatisfactory, you can complain to the CNIL, including evidence of the steps you have already taken.