Short answer
Labels such as “inference”, “internal”, “score” or “model output” do not decide whether GDPR rights apply. An opinion, assessment or prediction can be personal data where its content, purpose or effect links it to an identified or identifiable person, even if the controller created it or it also concerns someone else.
But the rights are not interchangeable. Access is broad and may require an intelligible reproduction of inferred data and enough context to understand it. Rectification concerns accuracy and completeness in light of the processing purpose; it does not let someone rewrite an honestly recorded opinion merely because they disagree. Erasure and objection depend on their own grounds and exceptions. Portability is narrower still and ordinarily excludes inferences created by the controller. Rights involving other people's data call for redaction and balancing, not an automatic refusal or automatic disclosure.
Restriction may temporarily freeze disputed data while accuracy or an objection is assessed.
Start with “personal data”, not the document label
Article 4(1) of the covers “any information relating to” an identified or identifiable person. In Nowak, concerning examination answers and an examiner's comments, the Court explained:
The use of the expression ‘any information’ ... potentially encompasses all kinds of information, not only objective but also subjective, in the form of opinions and assessments, provided that it ‘relates’ to the data subject. —
Information relates through its content, purpose or effect. A fraud probability, risk label, predicted preference or case note may qualify where used to evaluate or affect someone. One entry can be several people's personal data.
Not everything in a file about someone is their personal data. In the pre-GDPR judgment YS and Others, the Court distinguished personal facts in an immigration “minute” from the legal analysis itself. The analysis was an application of law by the authority, not information relating to the applicant, although personal data embedded in it remained accessible. That distinction remains useful, but it is not a general “internal notes” exemption: Nowak later confirms that subjective assessments can themselves relate to a person.
Access reaches data and intelligible context, not automatically every document
Article 15 covers personal data undergoing processing and context including purposes, categories, recipients, retention, sources and automated decision-making. Calling a qualifying inference proprietary or derived does not remove it from access.
The controller must supply a faithful and intelligible reproduction. That is not necessarily a photocopy of every source file, but documents or database extracts must be supplied where essential to make the data understandable and enable effective exercise of GDPR rights:
[T]he data subject must be given a faithful and intelligible reproduction of all those data. That right entails the right to obtain copies of extracts from documents or even entire documents or extracts from databases ... if the provision of such a copy is essential ... —
In Pankki S, dates and purposes of consultations of a customer's data were accessible. Employee identities were not automatically the customer's personal data, unless essential to exercise GDPR rights and balanced against those employees' rights.
Where automated decision-making within Article 22 is involved, Article 15(1)(h) additionally requires meaningful information about the logic, significance and envisaged consequences. In Dun & Bradstreet Austria, C-203/22, the Court held that meaningful information covers the procedure and principles actually applied and must enable the person to understand and challenge the result. Neither a bare complex formula or algorithm nor an exhaustive technical description is an intelligible explanation; the controller must instead explain the rationale in relevant, concise and accessible terms. Claimed trade secrets do not justify withholding everything; protected material may need to be put before a supervisory authority or court for balancing.
Correction is contextual, not a right to substitute one's opinion
Article 16 permits rectification of inaccurate personal data and completion of incomplete data, including by supplementary statement. Accuracy depends on why the data were collected and used. A wrong birth date, a score calculated from another customer's inputs, or a note falsely recording that an event occurred is a straightforward candidate.
In Nowak, incorrect answers accurately recorded what the candidate wrote, so rectification could not rewrite them after the event. A mixed-up script or misrecorded evaluation could be inaccurate. For models, correction may concern false inputs, attribution or a misrecorded output; altering the inference itself depends on accuracy for its purpose, not mere disagreement. Article 18 restriction may protect the person while accuracy is contested.
The right is not confined by the controller's preferred evidence rules. In Deldits, C-247/23, the Court held that an authority had to rectify inaccurate gender-identity data in a public register. A requester may be asked for relevant and sufficient evidence reasonably required in the particular circumstances, but an administrative practice could not make rectification conditional on proof of gender-reassignment surgery. Any restriction of Article 16 must satisfy Article 23, including its legislative, necessity and proportionality conditions.
Erasure and objection require separate legal tests
Article 17 applies only where a ground is met—for example, data are no longer necessary, consent is withdrawn without another basis, processing is unlawful, or an objection succeeds. Exceptions include expression and information, legal obligations or public tasks, protected archiving or research, and legal claims.
A personal-data inference can be erased when Article 17 applies, subject to its exceptions. Erasing an output does not ordinarily require destroying a general model whose parameters are not that person's personal data; it may differ if the model retains or exposes identifiable information.
In Darashev, C-312/24, the Court confirmed that retention said to be necessary for a legal obligation under Article 17(3)(b) must rest on a clear, precise and foreseeable legal basis, pursue a public-interest objective and be proportionate. If retention lasts longer than necessary, Article 17(1)(a) may again require erasure. The exception therefore does not validate indefinite storage merely because the record sits in an employment or official file.
Article 21 is not a general opt-out. For public-task or legitimate-interest processing, a person may object on grounds relating to their situation; processing must stop absent compelling overriding grounds or legal claims. Direct-marketing objections are absolute for that purpose. Other legal bases must be challenged under their applicable rules.
Portability usually stops before controller-created inferences
Article 20 applies only to personal data concerning the person that they provided to the controller, where processing is automated and based on consent or contract. It gives those data in a structured, commonly used, machine-readable format and, where technically feasible, direct transmission to another controller.
The includes data actively supplied and observed through use, such as activity or device readings, but excludes inferred or derived data created by the controller, such as an algorithmic profile or credit assessment. Portability also does not apply merely because access does. It cannot adversely affect others' rights, and direct transmission does not require incompatible systems to be made interoperable beyond the regulation's terms.
Records involving other people require a proportionate response
Articles 15(4) and 20(4), recital 63 and fundamental-rights proportionality protect other people. That may cover another customer's data, confidential communications, employee privacy, trade secrets or copyright. It is not a categorical veto. The Court's approach is to balance the competing rights and, wherever possible, communicate the requester's data through redaction, extraction, masking or another form that avoids harming others.
The controller should identify whose data each passage contains, whether disclosure makes the requester's data intelligible, and whether a less intrusive form works. Under Österreichische Post, C-154/21, recipient identities generally must be supplied unless identification is impossible or the request is manifestly unfounded or excessive.
A practical sequence
For each system and record, the controller should:
- identify the information relating to the requester, including opinions, inferences and outputs;
- record the processing purpose, legal basis, source, recipients and retention position;
- assess access, rectification, erasure, restriction, objection and portability independently;
- explain automated logic and consequences where Articles 15(1)(h) and 22 apply;
- separate or redact third-party and protected information rather than refusing wholesale; and
- explain any refusal, the specific GDPR ground, and complaint and judicial-remedy routes within Article 12's deadline.
Conclusion
GDPR rights follow information's nature and use, not folder names. Inferences and outputs often fall within access; internal legal reasoning may not, while facts and evaluative notes in the same record may. Rectification, erasure, objection and portability retain distinct conditions, and mixed-person records require separation and balancing. The defensible response is field-by-field and right-by-right, not a blanket “internal”, “proprietary” or “third-party data” answer.
Sources
This article provides general legal information, not advice for a specific matter. Laws, facts and procedural deadlines may change the result. Follow the linked primary sources and obtain local advice before acting.