GDPR Data Subject Rights

Last updated: April 2026

The GDPR grants individuals eight fundamental rights over their personal data. This guide explains each right, how to exercise it with FeatureSignals, and how our platform helps your organization meet its obligations as a data controller.

Right of Access (Article 15)

Data subjects can request a copy of all personal data you hold about them. FeatureSignals provides API endpoints and export tools to retrieve user data:

• Export user profile data via the Management API
• Retrieve audit log entries scoped to the requesting user
• Download evaluation history associated with the user context
• Response time target: within 30 days (GDPR requirement)

Right to Rectification (Article 16)

Data subjects can request correction of inaccurate or incomplete personal data. FeatureSignals enables:

• Self-service profile updates via the Flag Engine dashboard
• Admin-initiated corrections through the team management interface
• API-based correction for automated workflows
• Audit trail records the before/after state of all corrections

Right to Erasure — “Right to be Forgotten” (Article 17)

Data subjects can request deletion of their personal data under specific circumstances. FeatureSignals implements a two-phase deletion process:

1. Soft delete (immediate): Account is deactivated, user cannot log in. Data is flagged for deletion but recoverable for 30 days.
2. Hard delete (day 31): All personal data is permanently purged. Audit log entries are anonymized (user ID replaced with a non-reversible hash). Backups cycle out within 90 days.

Right to Data Portability (Article 20)

Data subjects can receive their personal data in a structured, commonly used, machine-readable format and transmit it to another controller. FeatureSignals supports:

Right to Object (Article 21)

Data subjects can object to processing of their personal data for direct marketing, research, or legitimate interest grounds. FeatureSignals:

• Does not use personal data for marketing or profiling
• Processes only the data necessary to provide the feature flag service
• Honors objection requests within 72 hours of receipt
• Maintains an objection register for compliance documentation

Rights Related to Automated Decision-Making (Article 22)

Data subjects have the right not to be subject to decisions based solely on automated processing that produce legal effects. FeatureSignals:

• Does not perform automated decision-making that has legal or similarly significant effects on individuals
• Flag evaluations are deterministic rule evaluations, not profiling
• Targeting rules are configured by your team, not by automated systems

How FeatureSignals Helps You Comply

As a data controller, your organization is responsible for handling data subject requests. FeatureSignals provides the infrastructure to make compliance straightforward:

Data Protection Officer

For GDPR inquiries, data subject requests, or to escalate a privacy concern:

• Email: dpo@featuresignals.com
• Privacy request form: Contact Privacy Team
• Response SLA: within 72 hours for urgent requests, 30 days for standard DSARs

Next Steps

• GDPR Overview
• CCPA / CPRA Compliance
• ISO 27701 PIMS Overview
• Security Overview