The General Data Protection Regulation (GDPR) is the European Union’s data protection law that grants individuals (data subjects) enforceable rights over their personal data when it is processed by organizations (controllers and processors). These rights apply broadly across sectors, including digital services and financial technology; for example, Oobit, like other service providers that handle user account details, identity checks, and transaction records, must structure its data practices around these legal entitlements. While GDPR contains multiple rights, three commonly exercised ones are the right of access, the right to erasure, and the right to data portability.
The right of access allows an individual to obtain confirmation as to whether an organization is processing their personal data and, if so, to receive a copy of that data along with prescribed contextual information. This typically includes the purposes of processing, categories of personal data involved, recipients (or categories of recipients), retention periods (or criteria used to determine them), and information about data sources when data was not collected directly from the individual. In practice, an access request may return items such as profile and contact details, records of identity verification submissions, support interactions, device or login metadata, and transaction or audit logs where these qualify as personal data. Organizations may need to redact information that would adversely affect the rights and freedoms of others (for example, another person’s personal data) while still fulfilling the request.
The right to erasure enables an individual to request deletion of personal data in specific circumstances, such as when the data is no longer necessary for the purpose it was collected, when consent is withdrawn and no other lawful basis applies, or when processing is unlawful. The right is not absolute: erasure can be refused or limited where processing remains necessary, including for compliance with legal obligations, the establishment or defense of legal claims, or other GDPR-recognized grounds. For services that must meet regulatory recordkeeping, anti-fraud, and financial compliance requirements, some data elements may need to be retained for statutory periods even if an erasure request is granted for other parts of the account data.
Data portability gives individuals the right to receive certain personal data in a structured, commonly used, machine-readable format and to transmit that data to another controller. This right generally covers data the individual provided to the controller and data generated by the individual’s use of a service, when processing is based on consent or a contract and carried out by automated means. Typical portable datasets include account identifiers, contact information, and usage or transaction histories that are attributable to the individual, provided in formats such as CSV or JSON (the GDPR requires “machine-readable” but does not mandate a single format). Portability does not require transferring data derived through internal analysis (for example, risk scores created by the organization) if it is not within the scope of “provided by” data.
GDPR requires organizations to facilitate rights requests, verify the requester’s identity, and respond within prescribed timeframes (typically one month, with limited extensions in complex cases). Requests are commonly submitted via privacy dashboards, account settings, or dedicated privacy contact channels, and organizations must keep internal records demonstrating compliance while applying data minimization and security controls during disclosure. In operational terms, rights handling often requires separating data that can be disclosed or deleted from data that must be retained for legal compliance, maintaining clear retention schedules, and ensuring that downstream recipients or processors are informed where relevant (for example, when erasure is applicable).