What it asks for. Controllers must provide information and communications to individuals in a concise, transparent, intelligible and easily accessible form, using clear and plain language. They must facilitate the exercise of rights and respond to requests without undue delay and within one month, extendable by two further months for complex or numerous requests with notice. Requests are generally free, although manifestly unfounded or excessive requests may be charged for or refused.
In practice. Organisations publish clear notices, provide easy request channels and track every rights request from receipt to response, including identity checks proportionate to the risk. Evidence includes request logs, response times, extension notices and documented reasoning for any refusal.
Common gaps. Deadlines are often missed because requests arrive through channels nobody monitors. Organisations also ask for more identification than is proportionate, which can itself breach the rules.