Under GDPR, what right do individuals have regarding their personal data?

Individuals under the General Data Protection Regulation (GDPR) have the right to have their personal data erased, commonly referred to as the "right to be forgotten." This allows individuals to request the deletion of their personal data when it is no longer necessary for the purposes for which it was collected, or they withdraw their consent upon which the processing is based. This right is particularly important in supporting individuals' autonomy over their personal data and ensuring that organizations handle that data responsibly.

In contrast, the other options do not align with the provisions of the GDPR. For instance, the regulation does not grant individuals the right to sell their personal data to third parties; instead, it focuses on protecting individuals’ data privacy. Moreover, while individuals can set limits on how long their personal data is retained, the GDPR does not support the idea of keeping data indefinitely. Finally, while individuals do have certain rights regarding the control of their data, the GDPR does not universally grant them control over data processing for all companies. Each organization's obligations vary depending on the context and legal basis for processing.