Most of the data subjects' rights require that the data subject contacts the data controller and asserts his or her rights. However, the data controller must fullfil some obligations whether or not the data subject contacts the data controller and invokes them:
- The obligation to provide information: the data controller must on their own initiative, provide the data subject with a range of information when they collect or receive information about him or her.
- Prohibition of decisions based solely on automatic processing, including profiling: the data controller may not make decisions based solely on automatic processing, including profiling.
If you are a data controller, it is you who must observe the rights of the data subjects. Your possible data processors cannot, as a general rule, be responsible for this.
A processor may in agreement with and on instructions from the controller undertake to observe the rights of the data subjects on behalf of the controller and under the responsibility of the controller.
Furthermore, there are some cases where the assistance of the processor is necessary to observe the rights of data subjects, for example by erasing or rectifying data physically held by the data processor.