Data Subject Rights: What Travelers Are Owed

Opening Scene

Crossing a border doesn’t strip a traveler of every right the moment they hand over their passport. They can still ask to see their own file, request a correction if an officer recorded their birthdate wrong, and in most functioning systems, eventually leave again if they choose. Those entitlements don’t vanish once someone is inside a country’s systems, and under modern privacy law, they don’t vanish once someone’s data is inside a company’s systems either.

In Plain English

Data subject rights are the specific, legally enforceable entitlements an individual retains over their own personal data for as long as an organization holds it. Under GDPR and similar laws, these typically include the right of access (seeing what data an organization holds about you), the right to rectification (correcting inaccurate data), the right to erasure, the right to data portability (getting your data in a usable format), and the right to object to certain processing, including profiling. These rights aren’t symbolic — organizations are legally required to respond to a valid request within a defined window, usually 30 days, and failing to do so is itself a compliance violation independent of whatever the original data issue was.

The Old Way

Before data subject rights were formalized and enforceable:

Individuals had essentially no standardized way to find out what data a company held about them, short of a lawsuit or a very persistent customer service escalation.
Correcting inaccurate data about yourself, when possible at all, depended entirely on a company’s internal policies rather than any external legal obligation to respond.
There was no consistent timeline for how quickly a company had to act on a person’s request, so requests could sit unanswered indefinitely with no real consequence.

Turning these into enforceable rights with defined response windows is what transformed data subject rights from a courtesy into an obligation.

What’s Changing (and Why AI Is the Reason)

Data subject access requests have grown sharply in volume as public awareness of these rights increases, pushing organizations to build dedicated intake and fulfillment processes rather than handling requests ad hoc.
Fulfilling these rights accurately depends on the same data lineage and cataloging discipline covered in this content library’s dedicated series, since answering “what data do you hold about me” requires actually knowing where every copy of that data lives.
AI models trained on personal data have complicated the right of access and the right to rectification in particular, because a model doesn’t store data the way a database does — correcting or removing one person’s influence on a trained model is a materially harder technical problem than deleting a row.

The Metaphor, Fully Extended

The Traveler’s Standing Rights	Data Subject Rights
The right to request and see your own immigration file	The right of access to your personal data
The right to have an officer’s clerical error corrected	The right to rectification of inaccurate personal data
The right to take your documents with you when you leave	The right to data portability
A defined window in which an official response is required	The statutory deadline, typically 30 days, for responding to a request

For Beginners: What to Actually Do

Try submitting a data access request to a company or service you use regularly, just to see the process firsthand and understand what a compliant response looks like.
Learn the five core rights this article covers: access, rectification, erasure, portability, and objection to processing.
Note the typical 30-day response window as a baseline expectation whenever you exercise one of these rights.

For Practitioners and Leaders: The Deeper Layer

Build a dedicated intake and fulfillment workflow for data subject requests rather than routing them through general customer support, since response deadlines are legally binding.
Invest in the lineage and cataloging capability covered in this content library’s dedicated data cataloging and lineage series, since it’s the technical prerequisite for answering access and rectification requests accurately and completely.
For any AI system trained on personal data, work out in advance how a rectification or erasure request would actually be fulfilled against a trained model, rather than discovering the gap when the first request arrives.

Quick Recap

Data subject rights give individuals enforceable entitlements over their own data, including access, rectification, erasure, portability, and objection.
These rights come with legally binding response deadlines, typically 30 days, independent of the underlying data issue.
Fulfilling these rights accurately depends on genuinely knowing where every copy of a person’s data lives.
AI models complicate rectification and erasure because a trained model doesn’t store or remove data the way a database does.

Where This Fits in the Series

Article 5 examined consent as the starting gate for lawful data collection. Article 7 zooms in on the single data subject right that has generated the most legal and technical debate of all: the right to erasure, more commonly known as the right to be forgotten.