Navigating Data Subject Rights: Avoiding Pitfalls in Customer Communication

In a decision of 1 February 2023, published by the EDPB in September 2026, the Spanish Data Protection Authority fined Securitas Direct €100,000 for making it difficult for individuals to exercise their data subject rights. The company directed individuals to a chargeable telephone number, a move that was deemed non-compliant with the General Data Protection Regulation (GDPR). This case serves as a cautionary tale for businesses about the importance of facilitating easy and cost-free access to data subject rights.

Under the GDPR, individuals have the right to access their personal data, request corrections, and even demand deletion in certain circumstances. Businesses are required to provide clear, transparent, and easily accessible communication channels for individuals to exercise these rights. Sending individuals to a chargeable phone line to make such requests, as in the case of Securitas Direct, can lead to significant penalties and damage to a company’s reputation.

For businesses, ensuring compliance with data subject rights is not just about avoiding fines. It’s also about maintaining customer trust and demonstrating a commitment to data protection. Transparent communication channels are essential for this. Businesses should provide multiple avenues for customers to exercise their rights, such as online portals, email, and freephone numbers. These channels should be easy to navigate, and the process for submitting requests should be straightforward and user-friendly.

It’s also important for businesses to train their staff on handling data subject requests. Employees should be aware of the company’s obligations under the GDPR and be equipped to assist individuals in exercising their rights. This includes understanding the types of information that can be requested and the timelines for responding to these requests.

In addition to internal processes, businesses should review their privacy policies and ensure that they clearly outline the rights of data subjects and the procedures for exercising those rights. This information should be prominently displayed on the company’s website and included in any communications with customers.

For companies operating in multiple jurisdictions, the complexities of complying with different national regulations can be daunting. Appointing an EU or UK representative under Article 27 can help businesses navigate these challenges. At Privacy Core Services, we provide EU and UK representative services to ensure that businesses meet their GDPR obligations across different regions. In summary, the case of Securitas Direct highlights the importance of facilitating easy access to data subject rights. By providing transparent and cost-free communication channels, businesses can avoid penalties, maintain customer trust, and demonstrate their commitment to data protection.