The GDPR gives people rights over their data: information, access, rectification, erasure, restriction, portability, objection, and the right not to be subject to a solely automated decision. The organization must make them easy to exercise and respond within a set period, in principle one month.
Example
A person asks for their account to be deleted: right to erasure.