Data subject rights under GDPR include the right to access, correct, delete, and restrict the processing of their data. Marketers must provide mechanisms for users to exercise these rights. This includes having a process for users to request data access or deletion and ensuring these requests are handled in a timely manner.