I tuoi dati (GDPR)

Strumenti

I tuoi diritti

• Lawful basis for processing

  GDPR Art. 6 · CELEX 32016R0679

  An organisation may process your personal data only if it has one of six lawful bases: your consent; performance of a contract with you; a legal obligation; protecting someone's vital interests; a task in the public interest; or its own legitimate interests, weighed against your rights and freedoms. It must settle on the basis before processing starts and tell you which one it relies on. Public authorities cannot invoke legitimate interests for their official tasks, and a basis cannot be swapped afterwards to rescue a use you have challenged.

• Special categories of data (sensitive data)

  GDPR Art. 9 · CELEX 32016R0679

  Data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership — together with genetic data, biometric data used to identify you, and data about health, sex life or sexual orientation — may not be processed at all by default. It becomes lawful only under a narrow exception: most often your explicit consent, employment or social-security law, a vital interest, information you have manifestly made public yourself, legal claims, or healthcare delivered by someone bound by professional secrecy. Ordinary consent buried in terms of service is not enough here — it must be explicit.

• What they must tell you (information duty)

  GDPR Art. 13, Art. 14 · CELEX 32016R0679

  An organisation must tell you on its own initiative — you should not have to ask — who it is, why it processes your data, on which lawful basis, who receives the data, how long it keeps it, whether it goes outside the EU, whether decisions about you are automated, and what rights you have, including withdrawing consent and complaining to a supervisory authority. If it collected your data from you directly, this must come at the moment of collection. If it obtained your data from somewhere else — a broker, a public register, another company — it must also tell you the source, within a reasonable period and at the latest one month, or at its first communication with you if that comes sooner.

• Right of access

  GDPR Art. 15 · CELEX 32016R0679

  You can ask any company or organisation whether it processes your personal data and get a copy of that data, plus the purposes, categories, recipients, storage period and source. The response is due within one month (extendable by two further months for complex requests, Art. 12(3)) and is free of charge in most cases.

• Right to rectification

  GDPR Art. 16 · CELEX 32016R0679

  You can require an organisation to correct inaccurate personal data about you, and to complete incomplete data, without undue delay.

• Right to erasure ("right to be forgotten")

  GDPR Art. 17 · CELEX 32016R0679

  You can ask for your personal data to be deleted, and the organisation must comply without undue delay — unless an exception applies, such as a legal obligation to keep the data (e.g. tax records), freedom of expression, or defending legal claims. A refusal must state its grounds; "we just don't want to" is not one.

• Right to data portability

  GDPR Art. 20 · CELEX 32016R0679

  You can receive the personal data you provided to a service in a structured, commonly used, machine-readable format and move it to another provider. It covers data processed by automated means on the basis of consent or contract; direct provider-to-provider transfer only where technically feasible.

• Right to object

  GDPR Art. 21 · CELEX 32016R0679

  You can object to processing based on "legitimate interests" and to any processing for direct marketing. For direct marketing the organisation must simply stop; otherwise it must stop unless it demonstrates compelling legitimate grounds overriding your rights.

• Right to restriction of processing

  GDPR Art. 18 · CELEX 32016R0679

  Instead of deletion you can demand that processing be frozen: the organisation may keep storing your data but must otherwise leave it alone. You can require this while it verifies data you say is inaccurate, when the processing is unlawful but you prefer restriction to erasure, when it no longer needs the data but you still need it for a legal claim, or while your objection under Article 21 is being assessed. During a restriction, anything beyond storage is allowed only with your consent, for legal claims, to protect someone else's rights, or for important public interest — and the organisation must tell you before it lifts the restriction.

• Automated decisions and profiling

  GDPR Art. 22 · CELEX 32016R0679

  You have the right not to be subject to a decision based solely on automated processing, including profiling, where it produces legal effects concerning you or similarly significantly affects you — an automatic loan refusal, an algorithmic rejection of a job application, an automated account closure. Such a decision is permitted only where it is necessary for a contract, authorised by Union or national law with safeguards, or based on your explicit consent; in the contract and consent cases you can always demand human intervention, put your own point of view, and contest the outcome. A score produced by a credit-reference agency can itself count as such a decision where the company receiving it draws heavily on it (CJEU, SCHUFA, C-634/21).

• Valid consent

  GDPR Art. 7, Art. 4(11) · CELEX 32016R0679

  Consent must be freely given, specific, informed and unambiguous, expressed by a clear affirmative act. Pre-ticked boxes are not valid consent (CJEU, Planet49, C-673/17). Withdrawing consent must be as easy as giving it — a hidden or multi-step "reject" next to a one-click "accept" fails this test.

• Transparency at work (employee monitoring)

  GDPR Art. 5(1)(a), Art. 88 · CELEX 32016R0679

  Personal data must be processed lawfully, fairly and transparently — covert monitoring of employees is very rarely lawful, and you must normally be informed before monitoring starts. The detailed rules for employment data are set nationally under Article 88, so they differ between member states: check your country's rules or ask the labour inspectorate.

• Response obligations and deadlines

  GDPR Art. 12 · CELEX 32016R0679

  When you exercise a data right, the organisation must respond without undue delay and at the latest within one month (extendable by two further months for complex cases — it must tell you about the extension). If it refuses, it must state its reasons and inform you of your right to complain to a Data Protection Authority and to seek a judicial remedy. Communication must be concise, transparent and in plain language.

• Exceptions to erasure

  GDPR Art. 17(3) · CELEX 32016R0679

  Erasure can be lawfully refused only where the processing is needed for: freedom of expression and information; compliance with a legal obligation or a public-interest task; public health; archiving in the public interest, scientific or historical research, or statistics; or establishing, exercising or defending legal claims. The company must say which exception it relies on — a bare refusal is not enough.

• Right to complain to a supervisory authority

  GDPR Art. 77 · CELEX 32016R0679

  If you believe your data protection rights have been violated, you can lodge a complaint with a Data Protection Authority — in the member state where you live, where you work, or where the violation happened. It is free of charge and does not require a lawyer.

• Data breaches — who must be told, and when

  GDPR Art. 33, Art. 34 · CELEX 32016R0679

  When personal data is breached — leaked, stolen, altered or lost — the organisation must notify the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to put people's rights at risk. Where the breach is likely to result in a high risk to you personally, it must also tell you directly and without undue delay, in plain language: what happened, the likely consequences, and what it is doing in response. It may skip telling you only if the data was unintelligible to whoever took it (properly encrypted, for instance), if it has since taken steps that remove the high risk, or — where individual notice would take disproportionate effort — by making a public announcement instead.

• Going to court and claiming compensation

  GDPR Art. 79, Art. 82 · CELEX 32016R0679

  Besides complaining to an authority, you can take the organisation to court directly — before the courts of the member state where it is established or where you habitually live — and claim compensation for material damage (money you actually lost) or non-material damage (such as distress). The organisation escapes liability only if it proves it was in no way responsible for the harm. An infringement on its own does not automatically entitle you to money: you have to show that damage actually occurred, though there is no minimum severity it has to reach (CJEU, Österreichische Post, C-300/21). Complaining to the authority and suing are independent routes — you can do both.