Except as limited by applicable law, EU data subjects have the right to access the personal data a company is processing on them. to restrict the processing. to correct incomplete or inaccurate personal data. to have their personal data deleted. and to object to their data being used for certain purposes.</p> <p> <strong>Retention:</strong> One of the core principles of the GDPR is “data minimization.” The GDPR requires that EU personal data should not be kept any “no longer than is necessary for the purposes for which the personal data are processed.”