Your Data, Your Rights: An Introduction to GDPR

Think about the last app or website you signed up for. Maybe it was a gaming platform, a streaming service, or a school portal. To create your account, you probably typed in your name, your age, maybe an email address, and chose a password. You might have clicked 'I agree' on a long page of text without reading it. Here is the question: once you typed that information in, where did it go — and who is allowed to use it? Your personal information has real value, and the law has something to say about how it must be treated.

Personal data is any information that can identify you as a specific individual. This includes obvious things like your full name, home address, phone number, and date of birth. It also includes less obvious things like your IP address (the unique number that identifies your device on the internet), your location history, your photos, and even your search history — because all of these can be traced back to you. In the European Union, and in the United Kingdom after it left the EU, a law called the General Data Protection Regulation — known as GDPR — sets strict rules about how organisations must handle personal data. It came into force in May 2018. GDPR gives individuals rights and places responsibilities on any organisation that collects or uses personal data. YOUR RIGHTS UNDER GDPR GDPR gives every individual several important rights: 1. The right to be informed — Organisations must tell you clearly what data they are collecting, why they need it, and how long they will keep it. This is usually done through a privacy notice. 2. The right of access — You can ask any organisation to send you a copy of all the personal data they hold about you. This is called a Subject Access Request (SAR). They must respond within one month. 3. The right to rectification — If data held about you is wrong or incomplete, you have the right to have it corrected. 4. The right to erasure — Sometimes called the 'right to be forgotten'. You can ask an organisation to delete your personal data in certain circumstances, for example if they no longer need it. 5. The right to data portability — You can ask for your data in a format that lets you move it to a different service provider. ORGANISATIONS' RESPONSIBILITIES Organisations that collect data — called data controllers — must follow key principles. They must only collect data they genuinely need (this is called data minimisation). They must keep it secure so it cannot be stolen or leaked. They must only keep it for as long as necessary. They must not share it with third parties without a lawful reason. If a data breach occurs — meaning data is accidentally lost or stolen — they must report it to the relevant authority within 72 hours. WORKED EXAMPLE Imagine a school uses an online quiz platform. The platform asks every student to enter their full name, school name, year group, and email address. Under GDPR, the platform must: tell students exactly why it needs that information and how long it will store it; keep that data secure; and not sell it to advertisers. A student could submit a Subject Access Request to find out exactly what data the platform holds. If the student left school and no longer used the platform, they could request that their data be erased.