The right to be informed

Informing people

Data controllers are obliged to provide data subjects with a certain amount of information at the data collection and/or processing stage.

Data subjects must be able to:

• know what justifies the data collection
• understand the conditions of processing
• retain control of their data

Information provided to data subjects must:

• be understandable (simple vocabulary, short sentences, avoid legal and abstract terms)
• be readable (be concise, prioritize elements by highlighting essential information)
• be accessible (users shouldn't have to search for information)
• provide a global overview of data processing (for example, a link to the data protection policy page or a dashboard for controlling data use)

To remember

To be lawful, the collection of personal data must be accompanied by clear and precise information on:

• the identity of the data controller
• the purpose of processing
• the mandatory or optional nature of the data to be supplied, and the consequences of failure to reply
• the data processors
• their rights (right of access, rectification and opposition)
• any transfers of data to countries outside the EU

Information must be given before data collection.

Individual rights

To remember

Individuals have rights to their data in order to maintain control over it. They can ask to exercice these rights.

These rights are as follows:

• Right of access: enables individuals to find out whether data concerning them is being processed and to obtain access to it. It also enables them to check the accuracy of their data and, if necessary, have it corrected or deleted.
• Right to rectification: allows inaccurate data to be corrected or completed.
• Right to object: allows individuals to object to the processing of their data. This right can be exercised at any time.
• Right to be forgotten (erasure): also known as the "right to be forgotten", enables individuals to request the erasure of their data from an organization.
• Right to data portability: enables people to manage their data so that they can reuse it for personal use. It also facilitates the free circulation of data from one service provider to another.
• Right to restrict processing: allows the use of a person's data to be frozen until he or she can fully exercise his or her rights.

Request to exercise a right

When a person asks an organization to respect one of his or her rights, he or she is making a request to exercise a right. request to exercise a right.

The data controller has one month to respond to the request.