With the adoption of the European Union General Data Protection Regulation (GDPR) on personal data protection in 2016 and its entry into force in 2018, all EU member states are required to provide maximum protection of personal data to individuals. The maximum protections of this regulation are expressed in various provisions, which are clearer, stricter and more practical compared to previous legal frameworks of the EU and other countries. One of the most important aspects of personal data protection is the flow of different rights to the data-subjects. In several articles, the EU regulation refers to the rights of data-subjects for the effective protection of their personal data. Given the importance of personal data and data-subjects protection and citizens’ rights to such protection, the need to examine this issue is also felt in regard to the Iranian legal system. In this paper, by explaining the said European regulation, it will be shown that although under Iranian law some rights of the data-subjects are protected, not all of these rights are provable and the existing rights are not without flaws. Therefore, there is a need for legal clarification on this subject.