Data Rights

You have rights over your personal data. This is not just a philosophical claim — in many parts of the world, these rights are written into law and enforceable against companies. Knowing what rights you have, which laws protect them, and how to actually exercise them transforms you from a passive source of data into an active agent who can make meaningful choices about your information.

The Foundation: Major Data Protection Laws

The most comprehensive data protection framework in the world is the General Data Protection Regulation, known as the GDPR. It became enforceable in the European Union in 2018 and applies to any company that processes personal data of EU residents — including companies based in other countries. The GDPR established a set of individual rights that have become a global benchmark. In the United States, there is no single national data protection law equivalent to the GDPR. Instead, there is a patchwork: the Children's Online Privacy Protection Act (COPPA) specifically limits data collection on children under 13; the California Consumer Privacy Act (CCPA) and its 2020 update give California residents a set of rights similar to the GDPR; and many individual states have passed or are passing their own laws. Other major economies — Brazil, India, Canada, Japan, South Korea, and many others — have enacted or are developing comprehensive data protection frameworks inspired in part by the GDPR model.

Your Core Data Rights

Under frameworks like the GDPR and similar laws, individuals typically hold several fundamental rights. The right to access means you can request a copy of all the personal data a company holds about you. Most major platforms now have a data download function — a portal where you can export everything the company has collected. The right to correction means you can require a company to fix inaccurate information in your profile. The right to erasure — sometimes called the right to be forgotten — means you can request that a company delete your personal data under certain conditions. This right is not absolute; companies can retain data for legal obligations or legitimate interests, but the burden is on them to justify keeping it. The right to data portability means you can take your data and transfer it to a different service. This matters most when a company has built a large profile of you and you want to switch to a competitor. The right to object means you can object to certain uses of your data — particularly direct marketing and profiling — and the company must stop. The right to know about automated decisions means that if a significant decision about you (like a loan, a job application, or a benefit) was made by an algorithm without human review, you have the right to know and to request human oversight.