Subject Access Requests
Individuals have the right under the GDPR to ask for a copy of the information stored about them and also to have any inaccuracies within that information corrected.
Requests must be responded to within 30 days and the individual cannot be charged for making a request unless they are being made excessively by the same person.
Along with the subject's own data, information about the period of retention and also when and how their data was collected should be supplied.
Gathering Data
In most cases data can be supplied in electronic format and there are a number of ways to access that data for individual Users:
- On the User details screen (following a User search)
- Through the User details API endpoint
- Send an email to support
Common Questions
What is GDPR?
The General Data Protection Regulation (GDPR) (Regulation (EU) 2016/679) is a regulation by which the European Parliament, the Council of the European Union and the European Commission intend to strengthen and unify data protection for all individuals within the European Union (EU). For more info, click here.
How can legal compliancy be ensured?
First, read the application Terms of Use and then research the many different types of worldwide legislation to review how each law impacts on the data you store and the emails you send.
What is double opt-in?
Double opt-in is a way to validate email addresses as people complete forms (signup, register etc.). Before being added to a List the User must first click the link on the email sent to their inbox. To find out more about double opt-in, click here.
What is a "Subject Access Request"?
An individual is entitled to obtain all of the information stored about them and this is commonly termed as a 'Subject Access Request'. For more info on how to deal with this type of request, click here.
What is the "Right to Be Forgotten"?
When an individual no longer wants their information to be stored they are able to exercise their right to be forgotten. Users can opt-out at any time but this goes a step further and removes all personally identifiable information relating to them. For more info on how to deal with this type of request, click here.