GDPR-12-04 Requirement 12 — Transparent information, communication and modalities for the exercise of the rights of the data subject

Facilitate exercise of data subject rights

Description

Controllers must facilitate the exercise of data subject rights under Articles 15 to 22.

Sign in to view the full obligation text, AI-generated applicability analysis, evidence checklists, and compliance mapping.

Provide information in transparent, accessible form with clear language

Provide information in writing or other means including electronic

Provide information orally when requested if identity verified

Cannot refuse to act unless unable to identify data subject

Provide information on action taken within one month

May extend response period by two months if justified

Inform data subject of extension within one month with reasons

Provide electronic response to electronic requests unless otherwise requested

Inform data subject of reasons for not taking action within one month

Provide information and communications free of charge

ReguLume automatically maps regulatory obligations to your system inventory, identifies compliance gaps, and generates remediation plans.

Get Started