Patients have several rights under GDPR, including the right to access their data, the right to correct inaccuracies, and the right to have their data erased. In the context of cancer research, patients can also object to the processing of their data and withdraw consent at any time. These rights ensure that patients maintain control over their personal information.