Oposiciones →
Module 7 of 7 · 15 min

Your rights over your data and where to complain

Free data protection course: read the module, review with the questions and move on to the next one. At the end, a test and a PDF certificate.

Module 7 of 7 · Course contents

Like anyone, you are also a data subject: your employer processes your payroll, contract and clock-in data.

Your rights

  • Access: to know whether your data is processed, which data, why and for how long (article 15).
  • Rectification of inaccurate data (article 16).
  • Erasure when it is no longer needed or was processed unlawfully, among other cases (article 17).
  • Objection to some processing; always to direct marketing (article 21).

Time limits and complaints

The controller must reply within one month, extendable by two more months if complex (article 12.3). If you think your data is mishandled, you can complain to the Spanish Data Protection Agency (AEPD) (article 77; Organic Law 3/2018, article 44).

In practiceYou can ask your employer in writing what data it keeps about you from time recording and who it has shared it with: it has one month to reply.

Source: Regulation (EU) 2016/679, General Data Protection Regulation (GDPR), articles 12, 15 to 17, 21 and 77 · Ley Orgánica 3/2018, de Protección de Datos Personales y garantía de los derechos digitales (Spanish data protection act, in Spanish), article 44

Quick review

Check that you've understood. These are questions from the final test: tap an answer to see whether it's right and why.

You ask your employer what data it holds about you. Which right are you exercising?

Within what time must the employer reply?

Who can you complain to if you think your data is mishandled?

Module practice test

5 new questions, different from the final test. Tap an answer to see whether it is right, why, and which rule it comes from.

1. When exercising the right of access, what can you find out?

2. Your employer has your bank account number wrong. Which right do you use?

3. When can you always object to processing?

4. Can you ask for erasure of data that was processed unlawfully?

5. What is the Spanish Data Protection Agency?

Course contents