The data subject has the right to obtain confirmation from the controller as to whether or not personal data concerning him/her are being processed; if this is the case, he/she has the right to be informed of such personal data and to receive the information specified in Art. 15 FADP.
The data subject has the right to request the data controller to correct incorrect personal data concerning him/her and, if necessary, to complete incomplete personal data (Art. 16 DPA). The data subject has the right to request the controller to delete personal data concerning him/her without delay if one of the reasons listed in Art. 17 DPA applies, e.g. if the data is no longer needed for the purposes for which it was collected (right to deletion).
The data subject has the right to request the controller to restrict processing if one of the conditions listed in Art. 18 DPA is met, e.g. if the data subject has lodged an objection to processing, for the duration of the controller's examination. The data subject has the right to object at any time, for reasons arising from his or her particular situation, to the processing of personal data relating to him or her. The data controller will then no longer process the personal data unless he can demonstrate compelling reasons for processing that are worthy of protection, which outweigh the interests, rights and freedoms of the data subject, or the processing serves to assert, exercise or defend legal claims (Art. 21 DSGVO).
Without prejudice to any other administrative or judicial remedy, every data subject has the right to lodge a complaint with a supervisory authority if the data subject considers that the processing of personal data relating to him or her is in breach of the DPA (Art. 77 DPA). The data subject may assert this right with a supervisory authority in the Member State in which he or she is resident, at his or her place of work or at the place where the alleged infringement is committed (see below).