Digital Sovereignty
Your Rights
What the law already gives you over your data, said once, simply, for where you live. Choose your country below; the statute, the company’s deadline and who to complain to are in each.
In one sentence each
The rights almost everyone has
- Access
- A copy of everything a company holds on you, free, within a fixed time.
- Correction
- Wrong data fixed.
- Erasure
- Data deleted when there is no good reason to keep it. Not every country grants this; the blocks below say which.
- Portability
- Your data in a file you can take elsewhere.
- Objection
- No to direct marketing, always; no to other uses, with reasons.
- Automated decisions
- Not to be judged by a machine alone when it matters, and to know when a machine has been trained on you.
- Complaint
- A regulator who hears you for free when a company is late or refuses.
By country
Six jurisdictions, as the law stood on 31 October 2026
United KingdomUK GDPR and the Data Protection Act 2018
Your Rights
- Access: a copy of everything they hold on you, free of charge
- Rectification: have wrong data corrected
- Erasure: have data deleted when there is no good reason to keep it
- Restriction: have them stop using it while a dispute is settled
- Portability: your data in a machine-readable file
- Objection: to direct marketing, always; to other uses, with reasons
- Automated decisions: not to be subject to one with legal effect without a human
Their Deadline
One month from the day they receive it. They may add two months for a complex request, but must tell you within the first month.
If They Miss It
Complain to the Information Commissioner's Office (ICO).
Companies may refuse a request they can show is manifestly unfounded or excessive, and may ask for proof of identity first.
European Union and EEAthe General Data Protection Regulation (EU) 2016/679
Your Rights
- Access (Art. 15)
- Rectification (Art. 16)
- Erasure, the "right to be forgotten" (Art. 17)
- Restriction of processing (Art. 18)
- Data portability (Art. 20)
- Objection, including to profiling and direct marketing (Art. 21)
- Not to be subject to a solely automated decision with legal or similar effect (Art. 22)
Their Deadline
One month from receipt, extendable by two months for complex or numerous requests, with notice in the first month.
If They Miss It
Complain to the data protection authority of your country (the EDPB lists every one).
The same rights apply across all 30 EU and EEA states; you complain to the authority where you live, work or where the breach happened.
California, United Statesthe California Consumer Privacy Act as amended by the California Privacy Rights Act (Cal. Civ. Code § 1798.100 and following)
Your Rights
- To know what personal information is collected, from where, why, and with whom it is shared or sold
- To delete personal information the business collected from you
- To correct inaccurate personal information
- To opt out of the sale or sharing of your personal information
- To limit the use of your sensitive personal information
- Not to be discriminated against for using these rights
Their Deadline
45 days from receipt, extendable once by a further 45 days with notice.
If They Miss It
Complain to the California Privacy Protection Agency (CPPA).
Applies to for-profit businesses above the law's thresholds (revenue, volume of data, or share of revenue from selling data), not to every company.
Brazilthe Lei Geral de Proteção de Dados, Law No. 13.709/2018 (LGPD)
Your Rights
- Confirmation that they process your data, and access to it
- Correction of incomplete, inaccurate or out-of-date data
- Anonymisation, blocking or deletion of unnecessary or excessive data
- Portability to another provider
- Deletion of data processed with your consent
- Information about who they have shared your data with
- To revoke consent
Their Deadline
A simplified answer at once; a full declaration of your data within 15 days.
If They Miss It
Complain to the Autoridade Nacional de Proteção de Dados (ANPD).
The LGPD applies to any processing carried out in Brazil or aimed at people in Brazil, wherever the company sits.
Canada (federal, private sector)the Personal Information Protection and Electronic Documents Act (PIPEDA)
Your Rights
- To be told whether they hold personal information about you, and to see it
- To know how it has been used and to whom it has been disclosed
- To challenge its accuracy and completeness and have it amended
- To withdraw consent, subject to legal and contractual limits
- To complain to the Commissioner if you are refused
Their Deadline
30 days from receipt, extendable by up to 30 more days with written notice and reasons.
If They Miss It
Complain to the Office of the Privacy Commissioner of Canada (OPC).
Quebec, British Columbia and Alberta have their own private-sector laws with their own regulators; Quebec's Law 25 adds erasure and portability.
Australiathe Privacy Act 1988 and the Australian Privacy Principles (APPs)
Your Rights
- Access to the personal information an organisation holds about you (APP 12)
- Correction of information that is inaccurate, out of date, incomplete, irrelevant or misleading (APP 13)
- To know the purposes of collection and who it is disclosed to (APP 5)
- To deal with an organisation anonymously or under a pseudonym where lawful and practicable (APP 2)
- To opt out of direct marketing (APP 7)
Their Deadline
A reasonable period; the OAIC's guidance treats 30 days as the outer limit for an organisation.
If They Miss It
Complain to the Office of the Australian Information Commissioner (OAIC).
Most small businesses with annual turnover under A$3 million are outside the Act; there is no general right of erasure yet.
To use them: sign in, and the letter and the clock are written for you.