Which statement best describes data subject rights under GDPR?

• A. Data subjects have no rights to access or delete their data.
• B. Data subjects have rights to access and request erasure, and the TA must support these rights.
• C. Data subjects can edit data directly in company systems without authorization.
• D. Data subjects lose rights if data is anonymized.

Answer: (B)

Under GDPR, individuals have control over their personal data, including the right to access what is held about them and the right to request erasure. The organization processing the data must support these rights: provide a copy of the data upon request, explain how it’s being used, verify the requester’s identity, and delete the data if the erasure is warranted, all within the required timeframe. The TA (trusted agent) or data controller has a duty to implement clear procedures for handling access and erasure requests and to ensure lawful processing continues or appropriately ends. While truly anonymized data falls outside GDPR, any data that remains identifiable must continue to be accessible for the subject’s rights. Data subjects do not gain blanket permission to edit data themselves, and rights are not extinguished simply because some data has been anonymized.