Data-protection law gives individuals enforceable rights over their personal data, and handling the resulting requests well is one of the most visible tests of a compliance programme. In a GLAM setting these requests collide with archival duties: a record may be someone's personal data and part of the permanent historical record, so the answer is rarely a simple yes or no.

The rights below follow GDPR terminology, but equivalents exist in the UK GDPR, LGPD, CPRA and elsewhere, so the workflow you build travels across markets.

The individual rights

  • Access (SAR) - a copy of their data plus supporting information about the processing.
  • Rectification - correction of inaccurate data (in archives, usually a linked note rather than altering the original record).
  • Erasure - the "right to be forgotten", heavily qualified for archiving in the public interest.
  • Restriction and objection - pause or challenge processing.
  • Portability - receive data in a structured, machine-readable form where processing is by consent or contract.
  • Rights around automated decisions - including profiling.

Running the workflow

Most regimes require a response within a set window - GDPR sets one month, extendable by two for complex requests - normally free of charge. A sound process verifies the requester's identity, logs the request, searches all relevant systems, applies exemptions and redactions, and records the reasoning. Third-party data appearing in the same records must be protected, which is where careful redaction meets your descriptive metadata and any IIIF-served images.

The archival exemptions

Erasure, rectification and restriction are limited where they would seriously impair archiving in the public interest (GDPR Article 89 with national provisions). This is not a blanket exit - you must show the collection genuinely serves that purpose and that safeguards such as access controls and minimisation are in place.

In practice. Keep a request register that timestamps receipt, identity check, search scope, exemptions applied and dispatch date. If a regulator ever asks, that log is your evidence you met the statutory clock and reasoned each redaction consistently.

Key takeaways

  • Individuals hold access, rectification, erasure, restriction, objection and portability rights, with statutory deadlines (one month under GDPR).
  • Archival public-interest exemptions limit erasure and rectification but must be justified per collection, not assumed.
  • Verify identity, protect third parties through redaction, and log every step as accountability evidence.

Check your understanding

Last modified: Saturday, 1 August 2026, 10:37 AM