Reviews
Part of Personal privacy rights guide: an overview
Privacy rights compared: access, correction and deletion
Privacy rights compared: what access, correction and deletion requests cover, the evidence each needs, their limits, and how appeals differ from complaints.
What to take away
- The route should match the result you want.
- Rights with similar names can have different scope across jurisdictions.
- Deletion, restriction, objection, withdrawal of consent, and opt-out are not synonyms.
- Portability is often narrower than a general account download.
- Appeals challenge a request decision; complaints challenge handling or compliance through a defined process.
- Deadlines differone month under the GDPR and UK GDPR, 45 days under California's CCPA, and 45 days under most newer US state laws.
Privacy rights compared by jurisdiction, the same labels carry different duties, different exceptions, and different deadlines. This comparison covers the UK and EU under the GDPR and UK GDPR, California under the CCPA and CPRA, the newer US state privacy laws, and federal agency records under the US Privacy Act of 1974. It does not state that every reader has every right.
Comparison table
Privacy rights at a glance
Access
- Best fit
- Learn data
- Evidence
- IDs, dates
- Common limit
- Exemptions
Correction
- Best fit
- Fix errors
- Evidence
- Stored value
- Common limit
- Opinion
Deletion
- Best fit
- Remove data
- Evidence
- Data, grounds
- Common limit
- Legal duties
Objection
- Best fit
- Challenge purpose
- Evidence
- Reasons, impact
- Common limit
- Overriding grounds
Best fit
- Access or know
- Learn what data and processing concern you
- Correction
- Fix inaccurate or incomplete data
- Deletion or erasure
- Remove eligible data
- Restriction
- Limit processing while an issue is resolved
- Objection
- Challenge a processing purpose
- Portability
- Receive or transmit eligible supplied data
- Opt-out
- Stop legally defined sale, sharing, ads, or profiling
- Complaint or appeal
- Challenge handling or a decision
Typical evidence
- Access or know
- Account IDs, systems, dates
- Correction
- Stored value and supporting record
- Deletion or erasure
- Data, purpose, account, grounds
- Restriction
- Accuracy dispute, objection, claim need
- Objection
- Specific reasons and impact
- Portability
- Account and desired format
- Opt-out
- Consumer identity or preference signal as required
- Complaint or appeal
- Request, receipt, reply, issue list
Common limit
- Access or know
- Exemptions, another person's information
- Correction
- Opinion or disputed assessment may not be a factual error
- Deletion or erasure
- Legal duties, claims, security, public interest, other exceptions
- Restriction
- Storage or permitted uses may continue
- Objection
- Organization may show overriding grounds in some cases
- Portability
- Applies only to defined data and legal grounds
- Opt-out
- Definitions and covered businesses vary
- Complaint or appeal
- Regulator, timing, and remedies vary
How the rights differ by jurisdiction
| Jurisdiction | Access | Correction | Deletion | Response deadline |
|---|---|---|---|---|
| UK and EU (GDPR, UK GDPR) | Article 15 | Article 16 | Article 17 | One month, extendable by two further months |
| California (CCPA/CPRA) | Cal. Civ. Code §§1798.100, 1798.110, 1798.115 | §1798.106 | §1798.105 | 45 days, extendable once by 45 days |
| Virginia (CDPA), Colorado (CPA), Connecticut (DPA), Oregon (OCPA), Texas (DPSA), Montana (MCDPA) | Yes | Yes | Yes | 45 days, extendable once by 45 days |
| Utah (UCPA) | Yes | No | Yes | 45 days, extendable once by 45 days |
| US federal agencies (Privacy Act of 1974) | Yes | Amendment request | No general erasure right | Set by agency rules |
Restriction (Article 18) and objection (Article 21) exist as standalone rights in the UK and EU; the US state laws listed here instead provide opt-out rights for targeted advertising, sale, or profiling. Each US state law reaches only residents of that state and businesses that meet its thresholds, and a complaint goes to that state's attorney general.
Access or right to know
Access can confirm whether data is processed, provide a copy, and supply information about purposes, categories, sources, recipients, retention, transfers, or automated decisions under the applicable regime — Article 15 of the GDPR and UK GDPR, or the right to know under California's CCPA. A right to know can use defined category or specific-piece rules, and every state law listed above grants a right of access.
Access concerns personal data, not unrestricted discovery of every document. Redaction can protect another person's data, privilege, investigations, security, and other interests recognized by law.
Correction or rectification
Correction fits an inaccurate address, date, account status, transaction attribution, or incomplete record. Quote the current value and the requested value. Supply evidence proportionate to the issue. The governing routes are Article 16 of the GDPR and UK GDPR and, in California, Cal. Civ. Code §1798.106; Utah's UCPA grants no correction right.
An unfavorable opinion is not necessarily inaccurate personal data. Ask the organization to record your challenge or supplementary statement when the law or process supports that outcome.
Deletion or erasure
Deletion asks an organization to remove covered data when stated grounds apply — Article 17 of the GDPR and UK GDPR, or Cal. Civ. Code §1798.105 in California. It may not cover records required for a transaction, law, claim, security control, public task, research, or expression.
Ask the organization to identify what it deleted, retained, and sent to processors. A disabled account or invisible profile does not prove backend erasure. Backup copies can follow a delayed protected cycle under some regimes.
Restriction
Restriction — Article 18 of the GDPR and UK GDPR — can pause or limit active use while accuracy, lawfulness, an objection, or a legal claim is resolved. Stored data may remain. Define which processing should stop and what condition should end the restriction. California's CCPA has no equivalent restriction right; it pairs a right to limit the use of sensitive personal information (Cal. Civ. Code §1798.121) with its opt-out rights.
Do not use restriction as a vague substitute for deletion. The legal grounds and permitted uses differ.
Objection
The ICO's right to object guidance explains objections under Article 21 of the UK GDPR, distinguishes objection from withdrawal of consent, and confirms the absolute right to object to direct marketing. It recommends a written record, specific reasons, desired outcome, and proportionate identity checks.
Direct marketing can receive an unconditional objection right under some laws. Other objections depend on a person's situation and the organization's grounds. Name the processing purpose instead of demanding that all use stop.
Portability
Portability aims to provide eligible data in a structured, commonly used, machine-readable format and may permit direct transfer where feasible, under Article 20 of the GDPR and UK GDPR and under equivalent provisions in the US state laws listed above. It commonly applies to data supplied by the person and processed automatically under specified legal grounds.
An export archive can include activity outside the legal portability right or omit contextual information needed for access. Ask which route the file satisfies.
Sale or sharing opt-out
California's regulator summarizes six major state rights in its CCPA FAQ, including rights to limit certain sensitive-data uses, opt out of covered sale or sharing, correct, know, delete, and receive equal treatment. The statutory sources are Cal. Civ. Code §§1798.100–1798.121: deletion at §1798.105, correction at §1798.106, opt out of sale or sharing at §1798.120, and limits on sensitive personal information at §1798.121. It also gives California-specific submission and response information. Those terms do not transfer automatically to another state or country.
An opt-out preference signal can communicate a choice to covered businesses under defined rules. A browser's cookie control or ad setting is not necessarily the same legal signal.
Complaint and appeal
An internal appeal asks an organization to reconsider a denial where the applicable law supplies that route. A complaint asks a regulator or another body to examine handling or compliance — a national supervisory authority under Article 77 of the GDPR and UK GDPR, the ICO in the UK, the California Privacy Protection Agency or the California Attorney General in California, and the state attorney general in the other US states. A court claim is separate and can involve cost and legal risk.
Before escalating, assemble the request, delivery proof, identity exchange, clarifications, extension notice, response, and a concise list of unresolved points. Follow the regulator's current order and deadline.
Common questions
Is deleting an account the same as exercising an erasure right?
Not necessarily. Account closure can trigger a product process with its own retention rules. A legal request may require a reasoned response.
Can I correct an opinion I dislike?
You can challenge inaccurate personal data. Whether an opinion is inaccurate depends on how it is recorded and the applicable law.
Does portability include inferred profiles?
Not always. Many portability rights focus on defined data provided by the person. Check the governing rule.
Is an unsubscribe link a sale or sharing opt-out?
Usually it addresses messages. A statutory sale or sharing opt-out can use a separate definition and control.
