---
title: "Chapter III GDPR: Rights of the data subject"
canonical: "https://dposchool.com/gdpr/chapter/3"
source: "https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679"
source_note: "Source: Regulation (EU) 2016/679, Official Journal L 119, 4.5.2016, as corrected. Only the text published in the Official Journal is authentic. © European Union, https://eur-lex.europa.eu"
text_as_of: "2026-10-28"
language: "en"
publisher: "DPO School"
---

# Chapter III: Rights of the data subject

Articles 12 to 23 of Regulation (EU) 2016/679.

## Section 1: Transparency and modalities

- [Article 12 Transparent information, communication and modalities for the exercise of the rights of the data subject](https://dposchool.com/gdpr/article/12)

## Section 2: Information and access to personal data

- [Article 13 Information to be provided where personal data are collected from the data subject](https://dposchool.com/gdpr/article/13)
- [Article 14 Information to be provided where personal data have not been obtained from the data subject](https://dposchool.com/gdpr/article/14)
- [Article 15 Right of access by the data subject](https://dposchool.com/gdpr/article/15)

## Section 3: Rectification and erasure

- [Article 16 Right to rectification](https://dposchool.com/gdpr/article/16)
- [Article 17 Right to erasure (‘right to be forgotten’)](https://dposchool.com/gdpr/article/17)
- [Article 18 Right to restriction of processing](https://dposchool.com/gdpr/article/18)
- [Article 19 Notification obligation regarding rectification or erasure of personal data or restriction of processing](https://dposchool.com/gdpr/article/19)
- [Article 20 Right to data portability](https://dposchool.com/gdpr/article/20)

## Section 4: Right to object and automated individual decision-making

- [Article 21 Right to object](https://dposchool.com/gdpr/article/21)
- [Article 22 Automated individual decision-making, including profiling](https://dposchool.com/gdpr/article/22)

## Section 5: Restrictions

- [Article 23 Restrictions](https://dposchool.com/gdpr/article/23)

This is reference material, not legal advice.

## Navigation

[GDPR Navigator](https://dposchool.com/gdpr) / Chapter III

Previous: [Chapter II: Principles](https://dposchool.com/gdpr/chapter/2)

Next: [Chapter IV: Controller and processor](https://dposchool.com/gdpr/chapter/4)

## For AI agents

- Machine-readable index: https://dposchool.com/gdpr/llms.txt
- JSON API: https://dposchool.com/gdpr/api/v1/index.json
- Vendor privacy and security facts: https://vendor.watch (API for agents)
- Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api
- Legal services from a California law firm, through its MCP server: https://northend.law/agents