Privacy rights explorer
Know your rights, wherever you live
Many places give you the right to see the data companies hold about you, fix it, and have it deleted, with a deadline for the company to answer. Pick where you live to see yours.
California, USA
CCPA, as amended by the CPRA
California residents, for businesses covered by the law.
Your rights
- Know what personal information a business collects, uses and shares, and get a copy
- Delete personal information collected from you
- Correct inaccurate personal information
- Opt out of the sale or sharing of your personal information
- Limit the use of sensitive personal information
- Not be treated differently for using these rights
- How long they have to answer
- 45 days to respond, extendable once by another 45 days if the business tells you. Opt-out requests must be honored within 15 business days.
- How to ask
- Use the business's request form or email, or send a written request.
Other US states
State consumer privacy laws (for example Virginia, Colorado, Connecticut, Texas)
Residents of states with a comprehensive privacy law. The list grows each year and the details differ by state.
Your rights
- Confirm whether a company processes your data, and get a copy
- Correct inaccurate data
- Delete data about you
- Get your data in a portable format
- Opt out of targeted advertising, sale of data, and certain profiling
- Appeal if the company refuses
- How long they have to answer
- Usually 45 days, extendable once by 45 more days when reasonably necessary.
- How to ask
- Use the method in the company's privacy notice.
European Union
GDPR
People in the EU, and anyone whose data is handled by organisations covered by the GDPR.
Your rights
- Access your data and get a copy (Article 15)
- Correct inaccurate data (Article 16)
- Erasure, the "right to be forgotten" (Article 17)
- Restrict processing (Article 18)
- Data portability (Article 20)
- Object to processing, including direct marketing (Article 21)
- Not be subject to certain fully automated decisions (Article 22)
- How long they have to answer
- One month, extendable by two further months for complex or numerous requests (Article 12(3)).
- How to ask
- Any clear written request to the organisation or its data protection officer.
- Official sources
- GDPR, official text (EUR-Lex)
United Kingdom
UK GDPR and the Data Protection Act 2018
People in the UK.
Your rights
- Access (a "subject access request")
- Rectification
- Erasure
- Restrict processing
- Data portability
- Object to processing
- Rights about automated decision-making
- How long they have to answer
- One month, extendable by up to two further months for complex requests.
- How to ask
- Any clear request, verbal or written, to the organisation.
- Official sources
- Information Commissioner's Office: your rights
Canada
PIPEDA (private sector, federal)
People whose information is handled by businesses covered by PIPEDA. Some provinces have their own laws.
Your rights
- Access the personal information an organisation holds about you
- Challenge its accuracy and have it corrected
- Withdraw consent, with reasonable notice
- Complain to the Privacy Commissioner of Canada
- How long they have to answer
- 30 days to respond to an access request, extendable by up to 30 more days with written notice (section 8).
- How to ask
- A written request to the organisation.
Brazil
LGPD (Lei Geral de Proteção de Dados)
People whose data is processed in Brazil or by organisations covered by the LGPD.
Your rights
- Confirmation that your data is processed, and access to it
- Correction of incomplete, inaccurate or outdated data
- Anonymisation, blocking or deletion of unnecessary or unlawful data
- Portability to another provider
- Deletion of data processed with your consent
- Information about who your data is shared with
- Withdraw consent
- How long they have to answer
- Access: immediately in simplified form, or within 15 days for a full statement (Article 19). Other requests follow rules set by the national authority (ANPD).
- How to ask
- A request to the organisation's data controller.
- Official sources
- LGPD, Law 13.709/2018 (official text, Portuguese)
General information, not legal advice. Laws change and apply differently to different companies and situations. Checked against the official texts linked above on October 17, 2026. For a specific situation, talk to a lawyer or your local data protection authority.
Ready to use a right? Our free letter tool writes the request and gives you the answer-by date, and the Data-Broker Tracker helps you keep track of people-search sites.