Furthermore, individuals gain knowledge in the following topics:

• Fundamentals of data privacy and data protection
• Basic principles of GDPR
• Data subject rights under GDPR
• Roles and principles of GDPR practitioner

What Are The Data Subject Rights Under GDPR?

Individuals whose personal data, such as name, address, or bank information, is collected, stored, or processed by an organization are referred to as data subjects. The following are data subject rights under GDPR.

Right to be informed

Organizations should inform their customer about the data being gathered, how it will be used, how long it will be kept, and with whom it will be shared. All of this information should be presented in simple language. The organization should convey the following information

• Organization information and contact details
• Purpose and legal basis for processing the personal data
• Third-party information
• Data retention period
• Subject rights provided under the data protection law
• Right to file a complaint

Right to access

Individuals have the right to access and receive a copy of their personal data. The organization should provide a copy of the personal data of the individual including:

• Purpose of the processing
• Categories of personal data they are processing
• With whom the data is shared including international organizations
• How long will the organization keep the data
• Data information is rectified, erased or transferred, restrict or object to processing.
• Source of collected data
• Data used for automated decision-making, including profiling

Right to rectification

Individuals have the right to request that their data be rectified if it is inaccurate or added to if it is lacking. If an individual makes this request, the organization should answer within one month. They should also take efforts to confirm that the data is inaccurate and rectify it.

Right to erasure

Individuals have the right to request to delete their personal data. They can request organizations to delete their personal data if:

• Personal information is no longer required.
• Person withdraws consent
• Personal information has been inappropriately processed.
• Individual objects to the processing, and the data controller sees no reason to continue processing data
• Data erasure is required for legal compliance

However, there are several circumstances in which organizations may deny the request.

Right to restrict processing

Individuals have the right to request that an organization limit how it uses their personal data. However, it can only be used in the following situations:

• Data is inaccurate
• Processing is illegal but the individual does not want the data erased and requests the restriction
• The data controller no longer needs the data but the individual wants the data preserved so the legal claim can be exercised
• The organization is taking measures to verify the data erasure request

Right to data portability

Data subjects have the right to request that their data be transferred or given to another controller. The data must be provided in a machine-readable format. However, the right is only applied to the data that an individual has submitted to the organization by consent or contract, and only if the processing is automated. This also applies to data relating to an individual's conduct, such as search inquiries, location data, and website history.

Right to object to processing

In certain circumstances, individuals have the right to object to the processing of personal data. They have a full right to object to processing for direct marketing purposes. Furthermore, individuals have the right to object if the processing is for an activity performed in the public interest and the exercise of governmental power or lawful interests.

Rights related to automated decision making including profiling

Individuals have the right not to be subjected to decisions based solely on automated individual decision-making with no human intervention and several sorts of profiling, which is the automated analysis of personal data to evaluate aspects of an individual such as work performance, economic condition, health, personal preferences, hobbies, dependability, behavior, or location. However, it does not apply if the processing is required by contract, and permitted by law.

Enrolling in the EU GDPR Practitioner Certification Training in Finland allows them to master the GDPR's concepts, rules, and obligations. It assists them in gaining knowledge to become a Data Protection officers in an organization.