What it means:
Every individual has the right to clear and accurate information about how personal data is collected, used, shared and stored. This includes knowing the purpose of processing, the lawful basis, how long the data will be kept, and the individual’s rights. The information must be provided at the time of collection and must be clear, concise and accessible, using plain language.

When it might not apply:
In limited cases, a firm may not be able to provide information, such as when doing so could interfere with an investigation. On such occasions, the firm is required to provide as much clarification as possible.

How to exercise it:
Individuals may check the firm’s privacy notice or ask the firm directly for this information. If the information is not provided or is unclear, a complaint may be raised with the QFC Data Protection Office.

What it means:
An individual may ask a firm whether it is processing their personal data and request:

• Details about how and why it is being used

• A copy of the data

• Information about who it is shared with

When it might not apply:
The Regulations permit certain exemptions, such as where providing the data would affect someone else’s rights or ongoing investigations. The firm is required to clarify the reasoning if an exemption is applied.

How to exercise it:
The individual should contact the firm and state that the Right to Access is being exercised under the Regulations. If the firm does not respond within 30 days or refuses without a valid reason, a complaint may be lodged with the QFC Data Protection Office.

What it means:
An individual may ask a firm to correct any inaccurate personal data or to complete incomplete data.

When it might not apply:
A firm may refuse to correct data if it is already accurate. A firm may also refuse rectification where it is not technically feasible, but only if it collected the data from the individual and clearly informed them at the time of collection that rectification would not be feasible.

How to exercise it:
The individual should contact the firm and state that the Right to Rectification is being exercised, explaining what data is inaccurate or incomplete and providing the correct information. If the firm does not respond properly, a complaint may be raised with the QFC Data Protection Office.

What it means:
In certain situations, an individual may ask a firm to delete their personal data, for example:

• If it is no longer needed

• If consent is withdrawn

• When the individual objects to the processing and the firm cannot demonstrate another lawful basis

• If the data is processed unlawfully

• Where the firm is subject to a legal obligation to delete the data

When it might not apply:
The firm may keep the data if required by law, needed for public interest, or for legal claims. If so, the firm should explain why.

How to exercise it:
The individual should contact the firm and state that the Right to Erasure is being exercised. If refused without a valid reason, the matter may be escalated to the QFC Data Protection Office.

What it means:
An individual may object to their data being processed for certain reasons, such as marketing or where the firm relies on “legitimate interests.”
An individual may object to direct marketing at any time, and the firm must stop immediately.

When it might not apply:
The firm may continue processing if it can show strong legal grounds or requires the data for legal claims. The firm must clearly explain this to the individual.

How to exercise it:
The individual should contact the firm and state that the Right to Object is being exercised. If unresolved, a complaint may be submitted to the QFC Data Protection Office.

What it means:
An individual may require a firm to stop actively using their personal data. The firm may keep the data but cannot use it unless a specific exception applies.

When this right can be exercised:

• The individual believes the personal data is inaccurate and the firm is checking it

• The processing is unlawful and the individual chooses restriction instead of erasure

• The firm no longer needs the data, but the individual needs it for legal claims

• The individual has objected to the processing, and the firm is deciding whether it can continue

What restriction involves:
Once restriction applies, the firm may store the data but must not otherwise use it while the restriction is in place.

When the firm may still use the data:
Even where processing is restricted, the firm may use the data:

• With the individual’s consent

• For legal claims

• To protect another person’s rights

• For important public interest reasons

The firm must inform the individual before the restriction is lifted.

How to exercise it:
The individual should contact the firm and state that the Right to Restriction is being exercised. If the firm does not comply, the matter may be escalated to the QFC Data Protection Office.

What it means:
An individual may request the personal data they provided in a format that allows them to reuse it or transfer it to another service provider.

When it might not apply:
This right only applies where:

• The data was provided by the individual

• It is processed electronically

• It is based on consent or a contract

How to exercise it:
The individual should contact the firm and state that the Right to Data Portability is being exercised. If refused, a complaint may be submitted to the QFC Data Protection Office.

What it means:
An individual has the right not to be subject to decisions that are made solely by automated systems (including profiling) if those decisions have a significant or legal effect on them.

When it might not apply:
This right does not apply if the decision is:

• Necessary for entering into or performing a contract

• Required by law

• Based on the individual’s explicit consent

Where the right does not apply because the decision is necessary for a contract or based on explicit consent, the individual must still be able to:

• Obtain human intervention

• Express their view

• Contest the decision

How to exercise it:
The individual should contact the firm and state that the Right related to Automated Decisions is being exercised. If unresolved, a complaint may be submitted to the QFC Data Protection Office.

What it means:
If a firm relies on an individual’s consent to process personal data, that consent may be withdrawn at any time.

When it might not apply:
Withdrawal does not affect processing already carried out. The firm may continue processing if it can rely on another lawful basis.

How to exercise it:
The individual should contact the firm and clearly withdraw consent. If the firm continues processing without a valid basis, a complaint may be submitted to the QFC Data Protection Office.

What it means:
An individual has the right to make a complaint to the QFC Data Protection Office if it is believed that data protection rights have been breached.

How to exercise it:
A complaint should be submitted to the QFC Data Protection Office with details of the issue and any steps already taken with the firm.