The short answer
The rights themselves are not changing this year. The right to access, rectification, erasure, restriction, objection and data portability is in the GDPR itself, and that text is not rewritten annually. What is shifting is the way those requests reach companies and how supervisory authorities and the European data protection authorities (EDPB) explain these rights. For a director or HR manager, this makes a practical difference, even though the statutory text does not change.
This does not mean you have nothing to keep track of. Guidelines from the Dutch Data Protection Authority and the EDPB are regularly updated, for example on how you verify the identity of a requester or how you handle a request received via a chat function or social media. These updates are not new law, but rather a more precise application of an existing obligation.
What does not change in the law itself
The core remains unchanged: a data subject may ask which data you process about them, may have incorrect data corrected, and may request erasure under certain conditions. The timeframe within which you must respond is in the GDPR itself and is not subject to annual review. Companies that think a new, shorter or longer response timeframe has been introduced this year are probably confusing it with internal procedures or communications that are not about the statutory text itself.
The exceptions, such as a legal retention obligation that prevents erasure, are also unchanged. What may shift is how strictly supervisory authorities interpret those exceptions in their guidelines. This is not a change in law, but it can mean that a justification that was sufficient last year must be documented more precisely this year.
What is actually changing this year
Three developments are relevant for SMEs, without the law itself having been amended. First, requests are increasingly coming in digitally, via a contact form, a chatbot or a response on social media, rather than by letter. This does not change the obligation, but it does affect whether a request is recognised as a formal request and reaches the right person in the organisation in time.
Second, there is growing attention to requests involving automated processing, for example when data has been used to build a profile or an AI application provided input for a decision. The EDPB regularly develops this subject further. Companies that use AI tools for customer contact or staff appraisal should therefore make sure they know what data is contained in them before a request comes in. This directly relates to the questions surrounding GDPR and AI tools in practice.
Third, there is a broader discussion at European level about evaluating the GDPR as a whole. This looks at whether rules for smaller organisations can be simplified, but no concrete legislative changes have been decided. Where things remain uncertain, we also report this as such here: there is no definitive date or content known, and speculating about it does not help a business owner move forward.
Who this affects
These shifts particularly affect organisations that have many contact moments with customers or employees: an office with a customer service desk, an installation company with a quote form on the website, or an HR department processing application data. The more channels through which someone can contact you, the greater the risk that a request arrives somewhere without being recognised as a formal GDPR request. This is not a legal risk we assess here, but rather a practical point worth discussing internally.
Also relevant is your relationship with your data processor agreements: if a customer makes a request to you, but the data is held by an external SaaS vendor, that vendor must be able to cooperate with you on access or deletion. You can check whether this is properly arranged contractually via the frequently asked questions about data processor agreements and SaaS tools.
How to keep track of this without having to figure it out each time
Because the legal text is stable but its interpretation shifts, it is especially important to know where the current state comes from and when it changes. gdpria.eu links each topic to its source in the GDPR and to the guidelines of the EDPB and the Dutch Data Protection Authority, so you don't have to keep track yourself of whether anything has been adjusted. For example, if you suspect a data breach, you can first check your position in a few questionsbefore you take further steps.
Do you want to know how this kind of information is kept track of and where the source reference comes from? Do the free quick-scan or read through the topics in the knowledge base, and decide for yourself whether a next step is necessary.