What is intervenability (Intervenierbarkeit) as a data protection goal?
Intervenability means that systems and processes are designed so that data subjects can effectively exercise their rights — including the right to access, rectification, deletion, and objection.
Definition: Procedures must be designed so that data subjects can effectively exercise the rights they are entitled to (e.g., access, rectification, deletion). The responsible entity must be able to intervene in the processing at any time.
Measures to implement intervenability:
| Level | Measures |
|---|---|
| User rights | Differentiated consent and objection mechanisms; standardized query and dialog interfaces for data subjects |
| Data level | Blocking and objection notices attached to data records |
| System level | Ability to disable individual functionalities and system components without losing the entire system |
Practical examples:
- A "Delete my account" button that actually works
- GDPR right of access — being able to export all data a company holds about you
- Consent management systems where users can withdraw consent at any time
- The ability to correct inaccurate personal data
Key insight: Intervenability means privacy rights must be technically enforceable, not just legally guaranteed. If a user requests deletion but the system can't actually delete their data from all locations, intervenability has failed.