European UnionGDPR Articles 12-21, Data Subject Rights
Regulation (EU) 2016/679, Arts. 12-21
In force since .
A data subject rights rule binding public and private bodies.
- Obligation class
- Data subject rights, Disclosure
- Audit expectation
- none
What it requires
- Honor a data subject's request to access, rectify, erase, restrict, port, or object to processing of their personal data within one month of receipt, a period that can be extended by two further months where necessary given the complexity and number of requests (Article 12(3)).
These lines are LexLint's reading of the law's text. Also read by: European Data Protection Board (guidance, recorded ); Case C-307/22 FT v DW, judgment of (First Chamber) (recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
- FINOS AIGF
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureNo
Private right of actionYes
Penalty structure
Article 83(5)(b) subjects an infringement of the data subjects' rights in Articles 12 to 22 to the higher administrative-fine tier, up to EUR 20,000,000 or 4 percent of total worldwide annual turnover of the preceding financial year, whichever is higher.
- Rule
- Higher of
- As of
- Currency
- EUR
- Fixed cap
- 20,000,000
- Turnover percentage cap
- 4
Who enforces it
Enforcement body
The data protection supervisory authority designated by each EU Member State under Article 51, coordinated on cross-border cases through the one stop shop mechanism, which does not apply to processing by public authorities or by private bodies acting under Article 6(1)(c) or (e) (Article 55(2)), and through the European Data Protection Board (Articles 68-76).
Enforcement record
Counts the fines that national data protection authorities imposed in calendar year 2025 (2,161): the sum of the number-of-fines column in the European Data Protection Board's Annual Report 2025, which gives for each of 30 authorities (the 27 Member States, Iceland, Liechtenstein and Norway) the number and the total amount of the fines it issued that year. The report's own total of those amounts is EUR 1,145,760,374. Fines only: the table does not count the reprimands, warnings, compliance orders or processing bans the authorities may also impose. Enforcement of the GDPR is national, and this table is the Board's Union-level count of it. The figures describe enforcement of the GDPR as a whole, not enforcement of Articles 12 to 21 alone.
- As of
- Currency
- EUR
- Source link
- https://www.edpb.europa.eu/system/files/2026-04/edpb-annual-report-2025_en.pdf
- Fines per year
- 1,145,760,374
- Actions per year
- 2,161
Settledness
- As of
- Case link
- https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62022CJ0307
- Guidance link
- https://www.edpb.europa.eu/system/files/2023-04/edpb_guidelines_202201_data_subject_rights_access_v2_en.pdf
- Case citation
- Case C-307/22 FT v DW, judgment of (First Chamber)
- Guidance body
- European Data Protection Board
- Open questions
- Outside a doctor-patient relationship, when does Article 15(3) entitle a data subject to a full copy of the documents containing the personal data, rather than a faithful and intelligible reproduction of the data themselves?
- How often may a data subject repeat an Article 15 request before it is 'excessive' under Article 12(5), given that the Board's guidelines say excessiveness depends on the sector and on how often the controller's database changes?
What it makes you log
Logging duty
Articles 12 to 21 set how a controller answers a data subject's requests for access, rectification, erasure, restriction, portability and objection, and name no log, record or document. Article 12(5) puts on the controller the burden of demonstrating that a request is manifestly unfounded or excessive, which is a burden of proof in a refusal and not a duty to keep a record.
- Kind
- None
- As of
Also on the record
EEA status
- Annex
- XI
- Status
- Incorporated
- Force date
- Joint committee decision number
- 154/2018
- Source link
- https://www.efta.int/eea-lex/32016r0679
- Decision date
What this law does
Articles 12-21 give a data subject access (Article 15), rectification (Article 16), erasure (Article 17), restriction (Article 18), portability (Article 20) and objection (Article 21) rights against the controller, ordinarily to be honored within one month.
Article 22 itself applies only where a decision described in Article 22(1) is made, and the Article 13(2)(f), 14(2)(g) and 15(1)(h) duties to disclose the existence of automated decision-making, and meaningful information about its logic, cover at least the decisions described in Article 22(1) and (4).
How courts have read itPremium data
Our analysis of this law draws on 18 court rulings.
What each ruling held, what it means for an app, and whether it still stands are premium data, in the Plus, Pro and Enterprise plans.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .