GDPR and UK GDPR User Rights

What it is

Users in the EEA, Switzerland, and UK have the right to access, correct, delete, port, restrict, or object to processing of their personal data, and may withdraw consent at any time or lodge a complaint with a data protection authority.

Why it matters (compliance & governance perspective)

The policy explicitly enumerates GDPR and UK GDPR data subject rights and provides a mechanism for exercising them through account settings, giving EEA and UK users enforceable controls over their personal data.

This document changed recently

Consumer impact (what this means for users)

EEA, Switzerland, and UK users can request access to, correction of, deletion of, or portability of their personal data, and can object to or restrict processing, by visiting www.midjourney.com/account; consent withdrawal does not affect prior lawful processing.

What you can do

Institutional analysis (Compliance & governance intelligence)

1) REGULATORY LANDSCAPE: This provision directly implements GDPR Articles 15 through 21 (access, rectification, erasure, restriction, portability, and objection rights) and UK GDPR equivalents. The right to lodge a complaint engages EU national data protection authorities and the UK ICO as relevant enforcement bodies. The policy's note that consent withdrawal does not affect prior processing is consistent with GDPR Article 7(3). The Swiss Federal Act on Data Protection provides equivalent rights for Swiss users. 2) GOVERNANCE EXPOSURE: Medium. The operational capacity to fulfill access, deletion, portability, and objection requests within GDPR's statutory timeframes (generally one month, extendable to three months for complex requests) creates ongoing operational obligations. The policy directs users to www.midjourney.com/account for rights requests, and compliance teams should confirm this mechanism is functional, documented, and capable of meeting response timeframes across all request types. 3) JURISDICTION FLAGS: EEA member states, the UK, and Switzerland are specifically addressed. Rights fulfillment obligations differ in detail between GDPR, UK GDPR, and Swiss FADP, and compliance processes should account for these variations. Users in other jurisdictions are not covered by this section of the policy. 4) COMPLIANCE CONSIDERATIONS: Legal and compliance teams should verify that the rights request mechanism at www.midjourney.com/account is operationally capable of handling all enumerated rights (access, rectification, erasure, restriction, portability, objection), that identity verification procedures are in place, that response timeframes are tracked and met, and that data subject request logs are maintained. The ability to fulfill deletion requests for data used in ML training should be specifically assessed. 5) CONTRACT AND VENDOR IMPLICATIONS: Where Midjourney processes personal data on behalf of enterprise customers, the rights fulfillment process should be coordinated with those customers' own data subject request workflows to ensure end-to-end compliance.

Applicable agencies

Applicable regulations

Provision details

Other risks in this policy

• Use of Personal Data for Machine Learning Training medium
• Inference Generation and Disclosure medium
• Advertising and Analytics Cookie Sharing medium
• Law Enforcement Disclosure with User Notification low
• Cross-Border Data Transfer via Policy Consent medium
• CCPA Do Not Sell or Share Opt-Out medium