Privacy & your data
How to exercise your data rights: a practical guide to GDPR, CCPA and the rest
You have a legal right to see, correct, export, and delete the data companies hold about you. Most people never use it. Here is what the rights actually are, how to make a request that cannot be ignored, and what to do when one is.
Data protection law gets covered as a compliance burden for companies. Far less is written about the fact that it hands ordinary people a set of enforceable rights — and that using them is mostly a matter of knowing what to ask for and in what words.
This guide covers the rights that exist in the major regimes, how to file a request that gets a proper response, and your options when a company stalls.
Which law applies to you
You are generally protected by the law of where you are, not where the company is. A US company serving European users is subject to the GDPR for those users.
- GDPR (EU/EEA) and UK GDPR — the broadest set of rights. Applies to anyone in the EEA or the UK.
- CCPA/CPRA (California) — strong rights, with a distinctive focus on the sale and sharing of personal information.
- Other US states — Virginia, Colorado, Connecticut, Utah, Texas and a growing list have comparable regimes. The details differ; the core rights of access and deletion are broadly similar.
- LGPD (Brazil), PIPEDA (Canada), POPIA (South Africa), APPI (Japan), Privacy Act (Australia) — all provide access rights of varying strength.
If you are outside all of these, many large platforms extend the same tooling globally because maintaining separate systems is more expensive than universal compliance. It is always worth asking.
The rights you actually have
Access. You can ask what personal data an organisation holds about you, why, who it has been shared with, and where it came from. This is broader than most people expect: it covers inferences and profiling, not just the details you typed in. The "download your data" button often satisfies only part of it.
Rectification. Inaccurate data must be corrected. Useful against credit reference agencies, data brokers, and anywhere a wrong record has consequences.
Erasure ("right to be forgotten"). Deletion, in defined circumstances. It is not absolute: an organisation can refuse where it has a legal obligation to retain, or where the data is needed to establish or defend legal claims. A bank cannot delete your transaction history on request.
Portability. A copy of the data you provided, in a structured, machine-readable format, so you can move it elsewhere. Narrower than access — it usually covers what you supplied, not what the company inferred.
Objection and restriction. You can object to processing based on legitimate interests. For direct marketing the right is absolute — no balancing test, they must stop.
Rights around automated decisions. Where a decision with legal or similarly significant effect is made solely by automated means, you can require human review.
Opt out of sale or sharing. The CCPA/CPRA framing. Under that regime, "sale" is defined broadly enough to include much of the ad-tech ecosystem.
Non-discrimination. Exercising a right must not lead to worse service or higher prices.
Making a request that works
Most requests that stall are vague, sent to the wrong address, or leave identity checks unanswered. Use this sequence, then track the response against the deadline that applies where you live.
| Stage | What to do | Timing |
|---|---|---|
| Prepare | Choose the right or rights you want to use. Set a practical scope, such as a service, account, or date range, and gather the account email, username, and relevant reference numbers. | Before you submit |
| Submit | Use the organisation's privacy portal or its published privacy contact. State the request plainly, include only the identifiers needed to find your records, and save a copy with the date and confirmation number. | Day 0 |
| Verify | If the organisation asks you to confirm your identity, reply through a channel you trust. Ask why any unusually sensitive document is necessary and whether a less intrusive check will work. | As soon as practical |
| Track | Note the response deadline under the law that applies to you. Check the relevant regulator's current guidance; some laws allow an extension if notice and reasons are provided. | From submission; diarise the applicable deadline |
| Review | Compare the response with each part of your request. Ask promptly for a missing item or an explanation, and keep the reply with your original record. | When the response arrives |
| Escalate | If the deadline passes without an adequate response, send a dated follow-up and then consider a complaint to the relevant regulator. Include your request, proof of delivery, verification messages, and the response. | After the applicable deadline or an unresolved refusal |
For a request about Seldeo, start with our Privacy Policy and Terms of Service. The Contact page lists the right inbox for privacy requests.
Find the right recipient. Look for a Data Protection Officer or privacy contact in the privacy policy. Many companies have a dedicated privacy portal — use it if it exists; it is routed to people whose job this is. Front-line support will not have the authority.
Say which right you are exercising. "Send me my data" invites a partial answer. Name the law or article if you know which one applies, but you do not need to get a legal citation exactly right to explain what you want.
Be specific about scope. Under access you are entitled to ask for the categories of data, the purposes of processing, the recipients or categories of recipients, the retention period, and the source of data you did not provide yourself. Ask for these explicitly, in a list.
Expect identity verification, within limits. A company may verify who you are, and should — otherwise a request becomes an attack. But verification must be proportionate. Being asked for a passport scan to confirm an email address you are writing from is usually excessive; push back and offer to confirm from the registered address instead.
Keep a record. Date, channel, reference number, and copies of everything. This is what a regulator will want.
A starting template. Remove options you do not need and adapt the wording to your local law:
Dear [company],
I am making a [access / correction / deletion / portability / objection / other] request about personal data associated with my account. My account identifier is [email, username, or customer number]. The relevant service or date range is [x].
Please [describe the action or information you want]. If information is withheld or the request cannot be completed, please explain the reason and tell me what review or complaint options are available.
Please confirm receipt, tell me if you need a proportionate identity check, and let me know the response timeframe that applies to this request.
[Name, date, contact address]
Deadlines
- GDPR / UK GDPR — one month, extendable by two further months for complex requests, but they must tell you within the first month and explain why.
- CCPA/CPRA — 45 days, extendable by another 45 with notice.
- Other regimes — time limits, extensions, and which requests are covered vary. Check the current guidance from your local regulator rather than assuming another country's deadline applies.
Requests are normally free. A fee is only permitted where a request is manifestly unfounded or excessive, typically repetitive.
When they ignore you
This happens, and there is a defined escalation path.
- Follow up in writing, referencing the original date and the statutory deadline. Say plainly that you will complain to the regulator. A surprising number of requests are resolved at this step.
- Complain to the regulator. In the EU, your national data protection authority; in the UK, the Information Commissioner's Office; in California, the California Privacy Protection Agency or the Attorney General. Complaints are free and you do not need a lawyer. Attach your log.
- Judicial remedy. GDPR provides a right to an effective remedy and to compensation for damage. This is a bigger step and worth advice, but the right exists.
Regulators generally cannot recover your specific data for you, and they will not act on every complaint. What they do is aggregate: repeated complaints against the same organisation is precisely what triggers investigations.
Regulator escalation decision path and formal complaint template
When an organization stonewalls or fails to respond within the statutory timeframe (typically 30 calendar days under GDPR/UK DPA, or 45 days under CCPA), filing a regulatory complaint is free and shifts legal accountability onto the controller:
The 3-point escalation decision path
Escalate to the supervisory authority if any of the following occur:
- Statutory deadline elapsed: 30 days have passed since your initial request with no formal response or valid extension notice.
- Unlawful rejection: The controller refused your deletion or access request citing general "internal policy" rather than an explicit legal exemption (e.g., anti-money laundering regulations or pending litigation).
- Manifestly incomplete disclosure: The controller provided generic technical logs while refusing to name specific third-party recipients, data brokers, or algorithmic profiling categories.
Directory of primary enforcement authorities
| Jurisdiction | Supervisory authority | Official intake portal |
|---|---|---|
| United Kingdom | Information Commissioner's Office (ICO) | ico.org.uk/make-a-complaint |
| European Union | Your local Member State DPA (e.g., CNIL in France, BfDI in Germany, DPC in Ireland) | edpb.europa.eu/about-edpb/about-edpb/members_en |
| California (US) | California Privacy Protection Agency (CPPA) / CA AG | cppa.ca.gov/webapplications/complaint |
| United States (Federal) | Federal Trade Commission (FTC) | reportfraud.ftc.gov (for deceptive privacy practices) |
| Canada | Office of the Privacy Commissioner of Canada (OPC) | priv.gc.ca/en/report-a-concern |
Formal regulator complaint template
Submit this text through the regulator's electronic complaint portal or via email:
To: [Data Protection Authority / Privacy Commissioner]
Subject: Formal Complaint under [GDPR Article 77 / UK Data Protection Act / CCPA] against [Company Name]
Dear Supervisory Authority,
I am lodging a formal complaint against the data controller identified below for failure to comply with statutory data subject rights obligations:
1. Data Controller Details:
- Organization Name: [Company Name]
- Website: [https://company.example.com]
- Privacy Contact: [dpo@company.example.com]
2. Nature of Violation:
- [ ] Failure to respond within statutory timeframe (30 calendar days)
- [ ] Improper refusal of Data Subject Access Request (Article 15)
- [ ] Improper refusal of Right to Erasure / Deletion (Article 17)
- [ ] Incomplete disclosure of third-party processing recipients
3. Chronology of Events:
- [Date 1]: Formal DSAR submitted via email to controller's designated DPO.
- [Date 2]: Automated acknowledgment received from controller (Case Reference: [Ref Number]).
- [Date 3]: 30-day statutory deadline expired with no substantive response or valid extension notice.
- [Date 4]: Follow-up warning sent; controller remained unresponsive / unlawfully refused.
4. Supporting Evidence Attached:
- Copy of original dated request email.
- Delivery / read receipts.
- Controller's acknowledgment / refusal correspondence.
I request that the Authority investigate this controller's handling of data subject requests and exercise its corrective powers to order compliance.
Respectfully submitted,
[Your Name]
[Your Country of Residence]
[Your Email Address]
[Your Phone Number]
Requests worth making
Some that reward the effort:
- Data brokers. Companies that hold detailed profiles on you that you never knowingly gave anything to. Access requests here are frequently revealing, and deletion requests work.
- Credit reference agencies. Errors are common and consequential.
- Former employers and old services. Retention periods are often exceeded through simple neglect.
- Advertising profiles. Most large platforms expose the inferred interests and demographics they have assigned you. It is worth seeing once.
- Anywhere you have a live dispute. An access request produces the internal record, including notes about you.
Realistic expectations
Two honest caveats.
Responses are often disappointing in shape: a large export of raw logs with no explanation, technically compliant and practically opaque. You can go back and ask for the contextual information — categories, purposes, recipients — which is what makes an export meaningful.
And deletion is not always complete, legitimately. Backups cycle out over time rather than instantly. Legal-hold data stays. A company saying "deleted from live systems, purged from backups within N days" is usually being accurate rather than evasive.
None of that undercuts the value of asking. These rights are only meaningful to the extent people use them, and the organisations with the worst practices are the ones least prepared for a well-drafted request.
General information, not legal advice. Data protection law varies by jurisdiction and changes regularly; check your own regulator's guidance for the current position.