Scope
This guide details the technical and operational steps needed to ensure compliant channels for data subjects to exercise their GDPR rights under Articles 15-22. It emphasizes Article 12(2)'s requirement to facilitate these rights by removing barriers, financial, procedural, or communicational, from your rights-exercise infrastructure.
Use this when you're:
- Auditing existing contact methods in privacy notices
- Configuring customer service systems that handle data subject requests
- Reviewing third-party vendor contracts for rights-exercise pathways
- Updating privacy notices after a service model change
Key Concepts and Definitions
Facilitation requirement: Article 12(2) GDPR requires controllers to actively make it easy for data subjects to exercise their rights. It's not just about allowing rights but ensuring the process is straightforward and free of obstacles.
Barrier: Any cost or complexity that discourages a data subject from exercising their rights. The Spanish DPA's decision against Securitas Direct highlights that financial barriers include indirect costs like premium-rate phone numbers, even if free alternatives exist.
Channel prominence: The way you direct data subjects is crucial. If your privacy notice highlights a chargeable contact method, having a free web form hidden elsewhere doesn't resolve the issue.
Rights under Articles 15-22: These include access, rectification, erasure, restriction of processing, data portability, objection, and automated decision-making rights. All must be exercisable without charge under Article 12(5).
Requirements Breakdown
Article 12(2) Core Mandate
Controllers must facilitate the exercise of rights under Articles 15-22 by:
- Providing clear information on how to exercise each right
- Ensuring the process is not burdensome
- Making channels accessible without financial cost
- Responding within one month (extendable by two months for complex requests)
Article 12(5) Fee Prohibition
You can't charge fees for processing requests unless they're clearly unfounded or excessive. Even then, you must justify why the request meets that threshold.
What constitutes a cost: The Securitas Direct case shows that directing data subjects to premium-rate numbers violates this requirement. The EUR 100,000 fine underscores that indirect costs are treated as seriously as direct fees.
Communication Requirements
Your privacy notice must include:
- Specific channels for exercising rights
- Contact details for your data protection officer (if appointed)
- The right to lodge a complaint with a supervisory authority
All listed channels must be free. Offering a paid "fast track" alongside a free option creates a barrier.
Implementation Guidance
Audit Your Contact Infrastructure
Review every place you reference how data subjects can reach you:
Privacy notices: Check for phone numbers. Ensure they're toll-free or standard-rate, not premium.
Video surveillance signage: The Securitas Direct violation stemmed from surveillance notices. If you use cameras, your signage must direct to free contact methods.
Website footers and help centers: Ensure consistency. Don't direct people to a paid support line for "data privacy questions."
Third-party processors: If vendors handle requests for you, their channels must meet the same standards.
Configure Acceptable Channels
Compliant options include:
- Web forms: Purpose-built request forms with clear submission confirmation
- Email addresses: Dedicated privacy@ or DPO@ addresses monitored regularly
- Standard postal addresses: No premium delivery requirements
- Toll-free phone numbers: Ensure phone support is free
Avoid relying solely on automated chatbots unless they can route requests to human review.
Document Your Process
Create internal procedures specifying:
- Who receives and triages rights requests from each channel
- Service-level agreements for initial acknowledgment (recommended: 48 hours)
- Escalation paths for complex requests
- Verification steps to confirm requestor identity without undue burden
Update Your Notices
When changing service providers or contact methods:
- Update all privacy notices within the timeframe required by your DPA (Spain required 12 months)
- Replace physical signage (surveillance notices, lobby postings)
- Update any processor agreements referencing old contact details
- Test each channel to confirm requests reach your intake team
Common Pitfalls
Assuming free alternatives cure the problem: Securitas Direct had free channels on their website, but the surveillance notice directed people to the 902 number. This specific direction created the violation.
Premium "customer service" numbers: If your general customer service line uses premium-rate numbers, don't reference it in privacy materials for rights exercise. Maintain a separate, free channel.
Email-only policies without monitoring: Listing an email address you check monthly doesn't meet the facilitation requirement. You need responsive monitoring.
Overly burdensome identity verification: Asking for notarized documents or in-person verification creates a barrier. Use proportionate verification, login credentials may suffice for account data access requests.
Vendor pass-through: Don't tell data subjects to "contact our payment processor directly" for data held by that processor on your behalf. You remain the controller and must facilitate the request.
Geofencing channels: Don't restrict web forms to certain countries if you process data from data subjects elsewhere. Your facilitation obligation follows your processing activities.
Quick Reference Table
| Requirement | Article | What You Must Do | What to Avoid |
|---|---|---|---|
| Facilitate rights exercise | 12(2) | Provide clear, accessible channels; respond within one month | Creating procedural friction; requiring specialized knowledge to submit requests |
| No fees | 12(5) | Process all requests free of charge unless manifestly unfounded/excessive | Charging for processing; directing to premium-rate contact numbers |
| Clear communication | 12(1) | Use plain language; specify available channels in notices | Burying instructions; referencing only paid support lines |
| Identity verification | 12(6) | Use proportionate measures to confirm requestor identity | Demanding excessive documentation; creating barriers to verification |
| Response timeframe | 12(3) | Respond within one month (extendable to three months total) | Ignoring requests; delaying without justification |
| Information provision | 13(2)(b), 14(2)(c) | List rights and how to exercise them in initial privacy notice | Omitting contact details; vague references to "contacting us" |
Penalty reference: Article 83(5)(b) GDPR subjects Article 12 violations to fines up to EUR 20 million or 4% of annual worldwide turnover, whichever is higher. The EUR 100,000 fine against Securitas Direct reflects the Spanish DPA's assessment of severity for this specific case.
Corrective measure timeline: When a DPA orders notice updates, expect deadlines of 6-12 months for physical signage replacement. Digital notices should be updated immediately upon determination of non-compliance.
