The General Data Protection Regulation (GDPR) establishes a comprehensive framework for data protection, granting individuals significant rights over their personal data. Key among these are the rights of the data subject, as outlined in Chapter 3 of the regulation. This includes the right of access (Article 15), which allows individuals to obtain a copy of their personal data, and the right to erasure, also known as the 'right to be forgotten' (Article 17), which allows them to request the deletion of their data under specific circumstances. The right to data portability (Article 20) further empowers individuals to receive and reuse their data.

B. GDPR mandates a lawful basis for processing data, such as consent, but it does not require companies to financially compensate individuals for data sales.

C. GDPR requires implementing appropriate technical security measures (Article 32) but does not mandate the public disclosure of specific software, which could compromise security.

D. GDPR requires notification for data breaches and transparency about processing activities, not for every single time an employee views personal information internally.

1. Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation).

Article 15

"Right of access by the data subject": "The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed

and

where that is the case

access to the personal data..."

Article 17

"Right to erasure (‘right to be forgotten’)": "The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay..."

Article 20

"Right to data portability": "The data subject shall have the right to receive the personal data concerning him or her

which he or she has provided to a controller

in a structured

commonly used and machine-readable format..."

2. University of California

Berkeley

Privacy Office. "Key Requirements of the GDPR." This resource outlines the fundamental rights of data subjects under GDPR

stating

"Individuals have the right to: ...Access their personal data... Have their data erased (the right to be forgotten)."

3. Voigt

P.

& Von dem Bussche

A. (2017). The EU General Data Protection Regulation (GDPR): A Practical Guide. Springer. DOI: https://doi.org/10.1007/978-3-319-57959-7.

Chapter 10

"Rights of the Data Subject

" pp. 117-158: This chapter provides a detailed academic analysis of the rights granted to individuals

including access

erasure

and portability

confirming them as core requirements.