Except for the cases referred to in Article 23 concerning legal obligations, public interest, or the exercise of official authority, the Data Subject may exercise against the data controller the rights provided for in Articles 15-22:
Confirmation of whether or not personal data concerning them is being processed, and, if so, obtaining access to it (right of access) art. 15;
Rectification of inaccurate personal data, or completion of incomplete personal data (right of rectification) art. 16;
Erasure of the data if one of the grounds provided for by the Regulation applies (right to be forgotten) art. 17;
Restriction of processing when one of the hypotheses provided for by the Regulation applies (right to restriction) art. 18;
To receive the personal data provided to the controller in a structured, commonly used, and machine-readable format and to transmit those data to another controller (right to data portability) art. 20;
Objection to the processing of personal data (right to object) art. 21;
The right not to be subject to a decision based solely on automated processing, including profiling (automated individual decision-making) art. 22.
The exercise of rights is not subject to any formal constraints and is free of charge.