1. Right of access: Individuals have the right to ask the controller to confirm if their data is being used and to request access to their personal information.
   
2. Right to rectification: Individuals have the right to make sure their personal data is accurate and up to date. They can ask for corrections or updates when needed.
   
3. Right to erasure or be forgotten: Individuals have the right to request the deletion of their personal data from the controller's records without delay.
   
4. Right to object and restriction of processing: Individuals have the right to say no to their data being used and can ask for limits on how it's used if they want.
   
5. Right to data portability: Individuals have the right to receive their information in a structured, machine-readable format or to have their data transferred to another organization, if feasible.
   
6. Right to be informed: Individuals have the right to know why and how their personal data is being used. They also have the right to know if their data is being shared with others. This is done by following the right legal rules for using data. If consent is needed, it's important to get it right.
   
7. Right to be notified: In the event of a data breach, individuals must be notified within 72 hours of the controller becoming aware of the breach.
   

                              

Request to  access data  (Right to access)

1. Open the user's record and click Data Privacy.
   
2. Under the Data Subject Requests section, click + Request.
   
3. In the New Request pop-up, select Request to access data.
   
4. Click Save, and the request will be added to the record.
   
5. Click Send email for the request to access data.
   
6. In the email composer, compose an email or select the email template with which you want to send the email, and send the email.
   
   

Request to rectify data  (Right to rectify)

1. Open the user's record and click Data Privacy.
   
2. Under the Data Subject Requests section, click + Request.
   
3. In the New Request pop-up, select Request to rectify data.
   
4. Click Save, and the request will be added to the record.
   
5. Click Send email for the request to rectify data.
   
6. In the email composer, select the email template with which you want to send the email, and send the email.
   
   

Request to export data  (Right to portability)

1. Open the user's record and click Data Privacy.
   
2. Under the Data Subject Requests section, click + Request.
   
3. In the New Request pop-up, select Request to export data.
   
4. Click Save, and the request will be added to the record.
   
5. Click Send email for the request to export data.
   
6. In the email composer, select the email template with which you want to send the email, and send the email.
   
   

Request to stop processing data (Right to stop processing)

1. Open the user's record and click Data Privacy.
   
2. Under the Data Subject Requests section, click + Request.
   
3. In the New Request pop-up, select Request to stop processing data.
   
4. Click Save, and the request will be added to the record.
   
5. Click Lock for the Request to stop processing data.
   
6. The record will be locked, and you cannot perform any actions for the record, as mentioned earlier.
   
   
7. You can unlock the record when a contact requests you to do so. To unlock the record, click Unlock. Once it is unlocked, you can edit the records, make calls, and send emails.
   
   

Request to delete data (Right to be forgotten)

1. Open the user's record and click Data Privacy.
   
2. Under the Data Subject Requests section, click + Request.
   
3. In the New Request pop-up, select Request to delete data.
   
4. Click Save, and the request will be added to the record.
   
5. Click Lock for the Request to stop processing data.
   
6. Click the Move to block list button to remove it from your account.
   
7. In the Blocklist Record pop-up, select Move to block list; the record will be removed, and the email address will be added to the block list.
   
   
8. Nonetheless, you can manually add a record with the same email address if needed; you will be warned with a notification.
   
   

Lawful basis of data processing   

1. Legitimate interests: Processing personal data is allowed when it's needed for the controller's or a third party's legitimate interests, unless it goes against the rights and freedoms of the individual.
   
1. Example: An organization may process customer data for direct marketing purposes if it can demonstrate a legitimate interest, such as promoting relevant products or services to existing customers. Similarly, employers may process employee personal data for administrative purposes, such as payroll processing or performance management, as long as it's done in a way that respects the rights and freedoms of the employees.
   
2. Contract: Personal data can be processed if it's necessary for fulfilling a contract with the individual or for taking steps at their request before entering into a contract.
   
1. Example: When someone purchases a product online, their personal data, such as name, address, and payment information are necessary for the organization to fulfill the order.
   
3. Legal obligation: Processing personal data when it's required to comply with the law.
   
1. Example: Businesses may need to process personal data for tax purposes or to comply with employment laws, such as providing employee salary details to tax authorities.
   
4. Vital interests: Personal data can be processed when it's necessary to protect someone's life.
   
1. Example: During a medical emergency, healthcare providers may need to access and process a patient's medical records to provide life-saving treatment.
   
5. Public interests: Processing personal data is permitted when it's in the public interest or for official functions performed by public authorities.
   
1. Example: Government agencies may collect and process personal data for statistical purposes, public health surveillance, or national security.

1. Consent: This is when individuals give clear permission for their personal data to be used for specific purposes. It requires an affirmative action from the individual, such as ticking a box or signing a form.
   
1. Example: If a user subscribes to a newsletter by providing their email address and ticking a consent box, they are allowing the organization to send them marketing emails.

Ways to get consent   

1. Consent Form: In Bigin, you can personalize consent forms with fields for communication preferences and consent statements. To create a consent statement, go to Settings > User and Controls > Compliance > Consent Form > Customize > Consent Statement.
   
   These forms can be shared via email templates, allowing you to request consent from individuals. Additionally, you have the option to send individual emails from a record or send mass emails to a list of records.
   
   
2. Manual Update: If you obtain consent during a phone call or face-to-face meeting, you can manually update the consent status in the Data Privacy section of a record.
   
   

Stages in consent management   

1. Pending: When a consent request hasn't been sent to data subjects.
   
2. Waiting: After sending the consent form, while awaiting a response.
   
3. Obtained: When consent is received from the data subject.
   
4. Not responded: When consent isn't received within the defined waiting period in Consent Settings.