What are my rights under GDPR or equivalent privacy law?

How the answer differs across 4 jurisdictions

The Short Answer

You have strong GDPR rights in Germany—including access, correction, deletion, restriction, portability, and objection—as reinforced by the German Federal Data Protection Act (BDSG). You can also claim damages for violations.

72 hours
Breach notification deadline for controllers
€20M
Max GDPR fine per violation
3 years
Limitation period for damages claims
1 month
Standard response time for requests
The Short Answer

Under GDPR and the Data Protection Act 2018, you have the right to object to unlawful data processing, request erasure, and lodge a complaint with the Data Protection Commission.

72 hours
Breach reporting deadline
€20M
Max GDPR fine
1 month
Response time for requests
2018
DPA enacted
European UnionFull article
The Short Answer

No, processing without consent is not always illegal under GDPR — consent is just one of six lawful bases; others include contract necessity, legal obligation, vital interests, public task, or legitimate interests.

6 lawful bases
GDPR Article 6
72 hours
Breach notification deadline
€20M or 4%
Max fine
30 days
Response to SAR
The Short Answer

You can make a subject access request (SAR) in writing or verbally to any UK company holding your personal data — they must respond within one month and provide all your data free of charge, unless the request is manifestly unfounded or excessive.

1 month
Response deadline
£0
Maximum fee
30 days
Standard timeframe
GDPR
Governing law

Read Full Articles

Not legal advice. This article is general information based on publicly available sources, written for educational purposes. Laws change and individual situations vary. Consult a licensed attorney in your jurisdiction before acting on anything you read here. Last reviewed: June 2026.