An organization collects or keeps your information.
Consent is one basis for using your data, but the law also allows use without it for reasons such as a contract, a legal claim, employment and social-protection rights, or protecting life or health.§§5, 7
What it protects
- You can see your data and who received it, and correct, update or delete it, withdraw consent or object to processing.§§11–13
- Approved changes and deletions must carry across connected systems.§14
- Consent must be informed, specific and withdrawable, and the organization must prove it obtained yours properly.§5
Where it falls short
- Refusing consent does not prohibit every use.
- Broad alternative grounds and weak operational guidance can make these rights harder to exercise.
- Deletion needs safeguards where personal data appears in journalism or other public-interest content.
Information about you is exposed in a breach.
The duty to report a breach applies only when significant harm is likely, and only toward the data authority: the law does not require telling the people affected.§20
What it protects
- A breach likely to cause significant damage must be reported to the data authority.§20
Where it falls short
- An unclear “significant” threshold leaves room for underreporting.
- Smaller breaches can still expose people to fraud, identity theft or reputational harm, and limit their chance to protect themselves.
A public authority processes your data without consent.
Your consent is not needed where your data is used for national security, defense, public order or the public interest, crime investigation, a court order, tax evasion or other listed purposes.§24
What it protects
- An exemption waives consent only: every other rule on handling your data still applies.§24(2)
Where it falls short
- Broad grounds, weak independent oversight and unclear procedures may let exceptional access become routine.
- That leaves you less practical control over state use of your data.
Your child uses an app.
Processing a child’s data needs a parent’s or guardian’s consent and must take the child’s rights and interests into account.§9
What it protects
- Your consent as a parent or guardian is needed before an organization collects or uses your child’s data.§9
Where it falls short
- The law leaves how parental consent is given to future regulations, and says nothing on verifying it or assessing age.
- Parental consent can stay valid until 18, with no step for the young adult’s own consent.
