Notes on the rights of the data subject
The data subject has the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data and the information listed in detail in Art. 15 of the GDPR.
The data subject has the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her. Taking into account the purposes of the processing, the data subject shall have the right to have incomplete personal data completed (Art. 16 of the GDPR).
The data subject has the right to obtain from the controller the erasure of personal data concerning him or her without undue delay where one of the grounds set out in Art. 17 of the GDPR applies, e.g. when the data are no longer necessary in relation to the purposes for which they were collected (Right to erasure).
The data subject has the right to obtain from the controller restriction of processing where one of the conditions set out in Art. 18 of the GDPR applies, e.g. when the accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data.
The data subject has the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her. The controller shall no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims (Art. 21 of the GDPR).
Without prejudice to any other administrative or judicial remedy, every data subject shall have the right to lodge a complaint with a supervisory authority, if the data subject considers that the processing of personal data relating to him or her infringes the GDPR (Art. 77). The data subject may exercise this right before a supervisory authority in the Member State of his or her habitual residence, place of work or place of the alleged infringement. In North Rhine-Westphalia, the responsible supervisory authority is: Landesbeauftragte für Datenschutz und Informationsfreiheit, Nordrhein-Westfalen Kavalleriestr. 2 – 4, 40213 Düsseldorf