⚑Access, erasure, objection

Six, and you should know all six, because they are asserted individually:

• Access (Art. 15): which data you hold, where it comes from, what for, how long, to whom it goes.
• Rectification (Art. 16): anything wrong must be corrected.
• Erasure (Art. 17): whatever no longer serves a purpose must go.
• Restriction (Art. 18): data stays, but may not be used — for the duration of a clarification.
• Data portability (Art. 20): handing over in a common format.
• Objection (Art. 21): against the processing; for advertising always and without giving reasons.

The objection to advertising is the most common, and the only one where there is no weighing up: it applies immediately.

One month from receipt — for all requests. It can be extended by two further months in particularly complex cases, but only if you give notice of the extension, with reasons, within the first month.

What that means in practice:

• Record it immediately when a request comes in. Not “I will do it when I have time”.
• Confirm receipt if it could take longer.
• Refusals are also subject to the deadline. Anyone who considers a request unfounded must say so, with reasons, within the deadline.

What does not extend the deadline: holidays, illness, staff changes, an unclear sender.

With an objection to advertising, the one-month deadline only applies to the reply — you set the block itself immediately.

In five steps:

1. Check identity — but proportionately. If the request comes from the address you have stored, that is usually proof enough. Demanding an ID card is usually not permitted.
2. Search all systems. Not just the CRM: also mailboxes, spreadsheets, notes, exports, the accounting system.
3. Compile what you hold — with origin, purpose, legal basis, storage period, recipients.
4. Enclose a copy of the data.
5. Inform them of their further rights, including the right to complain to the supervisory authority.

Point 2 is the laborious one. Anyone who knows everywhere data is held is done in an hour; anyone who does not, in a week.

Reply in writing and keep the reply.

No — but everything for which there is no longer a reason. The difference matters, and you must be able to justify it.

To be deleted: data you hold only for outreach and advertising. Notes, additional details, history.

To be kept, often mandatory:

• Commercial and tax records — invoices, contracts. Retention periods of six to ten years.
• A blocking note, so that the person does not reappear with the next import. That is not a way round the erasure but its implementation — Aurora Hive Sales keeps it as a blocklist and does not even store the address itself for it.
• Data for ongoing legal claims.

Reply with a clear breakdown: what has been deleted, what remains and why, and when it will be deleted.

What you should not delete: the objection itself. You need it as proof.

That depends on the Reason — and Aurora Hive Sales asks for it explicitly when deleting. “Delete”, after all, means two quite different things:

1. Tidying up. A duplicate, an old record, a typo, an address that never worked. The contact disappears from your lists — but the address may come back. If it turns up again later in an imported file, in the opportunity search or on an opportunity, the old contact is restored instead of being created a second time. It brings its previous history with it, and the history shows how it came back.

2. At the person’s request. Someone has demanded the erasure of their data. Then the address is also put on the blocklist and stays out — even if it appears in a file again later.

Choose the reason deliberately. It decides whether the same address ends up in a campaign again in three months or not.

The blocklist records addresses that may no longer be used at the request of the data subject. It is the practical implementation of Article 17 GDPR: deleting alone is not enough if the address comes back in with the next import.

An address gets onto it in two ways:

• When deleting a contact with the reason “At the person’s request (GDPR)”.
• By hand under Administration → Blocked addresses — for erasure requests that arrive by letter, by phone or via a solicitor.

From then on, the block applies at every point where an address could come in:

• Creating a contact is rejected.
• An imported file skips the row; the report says how many were affected.
• The opportunity search saves the opportunity but does not create a contact.
• A contact person on an opportunity is not created.
• In a campaign, the address does not appear as a recipient.

Everywhere the same sentence appears: “This address has been blocked at the person’s request.”

What is remarkable about it: the list itself contains no addresses. Only a check value is stored, from which the address cannot be calculated back. You can check whether a particular address is blocked — but nobody can read out the list and find out who is on it. That is intentional: a list of the people who do not want to be bothered would itself be another collection of personal data.

Under Administration → Blocked addresses. The menu item is reserved for administrators; anyone without administration rights does not see it.

What the list shows:

• An identifier instead of the address — the first eight characters of the check value.
• Time of the block.
• Who set it.
• Origin — whether it arose from deleting a contact or had been set by hand.
• Note, if one has been added.

There are three actions there:

1. Look up an address — you enter an address and find out whether it is blocked. That is the only way to connect an address with the list.
2. Block an address — for erasure requests received outside the program.
3. Lift the block — with a reason.

In the note, write where the erasure request came from (email of …, call on …, solicitor’s letter of …). That is the detail you need if a supervisory authority asks.

Yes, but only with a reason. Without a reason, lifting is rejected — that is a deliberate hurdle, because lifting a block means writing again to someone who explicitly did not want that.

The reason, time and person remain on the entry and can be read at any time via “Show lifted ones too”.

The legitimate case is rare, but it exists: someone has changed their mind, gets in touch again of their own accord, or has been blocked by mistake.

Important to know: to lift a block, you need the address. The list does not give it out — it does not store any, after all. If the address is no longer recorded anywhere, all that remains is “Look up an address” with a guess. That is the price of the list not keeping addresses.

Two further limits you should know:

• The block works via the email address. The same person with a second address is not covered by it.
• Deleting a contact hides it but does not remove the row from the database. If you really want to remove the data, take the route of the data protection erasure under Administration → Legal. It deletes the records and sets the block; the note on the page says both.

Immediately and completely — with advertising there is no weighing up and no follow-up question.

1. Set the block before you reply. That way no running campaign can still reach the person.
2. All channels, not just the one through which the objection came. Anyone who objects to email advertising usually does not want calls either.
3. Confirm briefly. Without follow-up questions, without an attempt to win them back.
4. Do not delete, but block — otherwise the address will be back in the list with the next import.

An objection has no formal requirements: orally, by email, via an unsubscribe link, in conversation. It does not need to be justified and applies permanently.

And it applies even if the unsubscribe link did not work.

Then correct it — without delay, and without lengthy checks on its accuracy. For simple details (name, address, job title), the data subject’s statement is the best available proof.

What you should bear in mind:

• Notes are data too. An assessment that the person considers wrong is a tricky case — opinions cannot be “rectified”, but false statements of fact can.
• Inform recipients. If you have passed on the wrong data, you must communicate the correction as far as possible.
• Supplement rather than delete where appropriate: an incomplete detail is completed.

And the practical side effect: a rectification request is free data maintenance. Accept it graciously.

That is data portability under Art. 20, and it is narrower than it sounds.

It only applies to data that

• the person provided themselves,
• is based on consent or a contract,
• is processed automatically.

Not covered: your own notes, assessments, derived details, data from research.

What you hand over: the relevant data in a common, machine-readable format — a CSV file is enough.

In practice this right is asserted rarely, and mostly together with an access request. When it does come, the answer is usually considerably smaller than the access response.

Four things that together take half a day and shorten every request from days to hours:

1. A list of everywhere data is held. CRM, mailboxes, spreadsheets on drives, accounting, website forms, newsletter tool, exports.
2. Document the origin. For every contact: where it comes from. That is the detail hardest to establish after the fact for an access request.
3. Set deletion periods. How long does what stay — and who tidies up.
4. A reply template for access, erasure and objection. Do not formulate it from scratch when it is urgent.

And: name a person with whom such requests land. A request sitting in a general mailbox gets overlooked, and then the deadline runs out.

That is an access request, and the origin is expressly part of the response (Art. 15 (1) (g)).

So you must be able to say:

• From which source the data comes: an enquiry, a trade fair, a directory, research, a bought data set.
• When it was collected.

If you do not know, that is a problem in itself: without documented origin you can neither answer such requests nor justify why you were allowed to write to the person.

The advice that follows from this one question: from today, record for every new contact where it comes from. One field, three words — and you can answer any such request in five minutes.

That does not change your obligation — but it changes how you handle it:

• Check the power of attorney. A representative needs one; ask for it if none is enclosed.
• The deadline still runs from receipt, not from presentation of the power of attorney.
• Reply factually. A solicitor’s letter calls for a written reply, not a phone call.
• Say no more than necessary. Answer what has been asked.

Such requests often come in series from service providers who request access on behalf of many people. That is permitted, and the best preparation for it is again point 1 from the preparation: knowing where data is held.

If compensation is demanded, it is no longer an access case. Then get legal advice.

Then you will receive an enquiry from the authority, and you should take it seriously, but without panic.

What needs to be done:

1. Note the deadline. Authority deadlines are short and are not extended tacitly.
2. Compile the facts before you reply: what happened, on what basis, what you have changed since.
3. Reply completely and truthfully. Supervisory authorities react considerably more harshly to incomplete information than to the original infringement.
4. Describe the remedy. What you have changed so that it does not happen again is the most important part of the reply.
5. Legal advice if in doubt — at the latest when a fine is on the table.

Most proceedings end without a fine if the infringement is admitted and remedied.

Then a very short deadline runs: 72 hours from becoming aware of it for notifying the supervisory authority, if there is a risk to the people affected.

The procedure:

1. Stop it. Lock accounts, change passwords, disconnect affected systems.
2. Establish what is affected: which data, how many people, which period.
3. Document — even if in the end you do not have to notify. The documentation obligation always applies.
4. Notify if there is a risk. If in doubt, notify; one notification too many has no consequences, one too few does.
5. Inform the people affected if there is a high risk.

Typical cases: a lost laptop, an email to many recipients with an open distribution list, a hacked account, a file accidentally made public.

And: the 72 hours also run at the weekend.

That is the most common data protection incident in small businesses of all — and yes, it is one.

What needs to be done:

1. Do not try to recall it. A “recall” email makes the matter more public.
2. Assess: how many addresses, how sensitive is the context? A distribution list of club members is something different from one of patients or debt advice clients.
3. Document.
4. Notify if there is a risk — with a sensitive context, practically always.
5. Inform the people affected and apologise. Briefly, factually, without excuses.

And the prevention that makes this case impossible: do not send mass emails by hand from the mail program. That is exactly what campaigns are for — there, every recipient gets their own email.

For details about health, ethnic origin, religion, political opinion, trade union membership, sex life and biometric data, there is a general prohibition on processing with narrow exceptions (Art. 9).

This affects more businesses than you might think:

• A note “uses a wheelchair” is a health detail.
• “Not available on Saturdays, orthodox” is a detail about religion.
• A remark about a pregnancy likewise.

What you should do: do not record such details in the first place, unless they are genuinely necessary for the service and you have a sound legal basis — usually express consent.

With children there is an additional point: under the age of 16, consent requires the agreement of the people with parental responsibility.

Factually, completely, politely, and without justifying yourself.

A structure that works:

1. Confirmation: “We have received your request of …”
2. What you have stored, as a list or an enclosure.
3. Origin, purpose, legal basis, storage period, recipients.
4. What you have done — blocked, deleted, corrected.
5. What remains and why, with the deadline.
6. Information about the further rights and the right to complain.
7. Contact person for questions.

What you should leave out: explanations of why you are in the right, and attempts to change the person’s mind. A response to an access request is not a negotiation.

Reply in writing and keep the reply — proving that you replied on time is up to you.