Understanding Data Rights Requests in 2025

Your Guide to Access, Delete, and Manage Personal Data
Know your rights, exercise control over your personal information, and stay compliant in the age of privacy laws like GDPR and CCPA.
A person at a computer submitting a data rights request form online

Data rights requests empower you to control your personal information held by organizations. Whether you want to see what data a company collects, correct inaccuracies, delete your profile, or transfer your data elsewhere, these rights are now enshrined in global laws. In 2025, as digital footprints grow and privacy concerns rise, knowing how to make (or respond to) a data rights request is essential for both individuals and organizations.

A person at a computer submitting a data rights request form online

What Are Data Rights Requests?

A data rights request is when an individual asks a company or organization to access, correct, delete, or receive a copy of their personal data. For example, you might request a copy of all the information a retailer has about your account, or ask a social media platform to erase your entire profile. These rights are protected by privacy laws like GDPR (Europe), CCPA (California), and similar regulations worldwide.

Real-World Example: You receive a marketing email from a company you no longer use. You can submit a data rights request to see what data they have, correct or delete it, or opt out of marketing. Companies are legally required to respond.

Legal Foundations: GDPR, CCPA, and More

Modern privacy laws give people clear rights over their data. Two of the most influential are:

  • GDPR (General Data Protection Regulation – EU): Grants the right to access, correct, delete ("be forgotten"), restrict, and port your data. Applies to any company handling EU residents’ data, worldwide.
  • CCPA (California Consumer Privacy Act): Gives California residents the right to know, delete, and opt out of data sales. Includes strict timelines and penalties for non-compliance.

Many other regions and countries have similar laws. Even if you’re not in the EU or California, organizations are increasingly granting these rights to all users for simplicity and trust.

Core Data Rights Compared
RightGDPRCCPAOther Regions
Access✓✓Varies
Correction✓Varies
Deletion✓✓Varies
Portability✓Varies
Opt-out of Sale✓Varies
Restrict Processing✓Varies
See our privacy policy for more on how we handle your data.

Types of Data Rights Requests (with Examples)

Right of Access
Request a copy of all personal data a company holds about you.
Example: "Send me all information you have on my account."
Right to Deletion
Ask for your data to be erased (“right to be forgotten”).
Example: "Please delete all my records and unsubscribe me."
Right to Correction
Fix inaccurate or outdated information.
Example: "Update my phone number to [new number]."
Right to Restrict Processing
Limit how your data is used, for example, stop marketing but keep your account.
Example: "Do not use my information for advertising."
Right to Data Portability
Receive your data in a portable, machine-readable format.
Example: "Send my profile and order history as a CSV."
Right to Opt-Out (CCPA)
Request that your data is not sold or shared.
Example: "Do not sell my personal information."

How to Make a Data Rights Request (Step-by-Step for Consumers)

  1. Identify the company and the specific right you wish to exercise.
    Find the privacy policy or data rights page—look for terms like "privacy", "data request", or "contact us".
  2. Prepare your request.
    Clearly state what you want (e.g., “I request access to all personal data you hold about me under GDPR”). Include enough information for the company to identify your account (name, email, account number).
  3. Submit your request.
    Use the official email address or web form. Some companies require identity verification before releasing data.
  4. Wait for a response.
    Companies must respond within a set timeframe (typically 30–45 days). They may ask for more info to verify your identity.
  5. Review the response.
    If your request is denied or not fully addressed, ask for clarification or escalate to a relevant authority (like a data protection office).
Tip: Keep a copy of your request and any responses for your records. Companies are required to respond in plain language and provide contact details for follow-up.

How Organizations Should Handle Data Rights Requests

  1. Receive and log the request. Assign a unique ID or case number, and record the date received.
  2. Verify the requestor’s identity. Ask for reasonable proof before disclosing or altering personal data.
  3. Locate all relevant data. Search across databases, email, backups, and third-party processors.
  4. Assess the request. Determine if you can fulfill the request as is, or if any legal exceptions apply.
  5. Respond within statutory deadlines. Most laws require a response within 30–45 days. Communicate clearly if you need more time.
  6. Document everything. Keep detailed records of the request, your actions, and your response for compliance audits.
  7. Train staff and update procedures. Regular training and clear processes help prevent mistakes and missed deadlines.
Compliance Tip: If you use vendors or cloud services, ensure they can help you locate and manage user data. See our Email Compliance Guide for more technical tips.

Common Challenges & Solutions

For Consumers
  • Identity Verification: Companies may ask for proof before fulfilling your request. Have ID or account info ready.
  • Unclear Responses: If the company’s reply isn’t clear, ask for a breakdown or explanation.
  • Delays: Follow up if you don’t hear back within 30–45 days.
  • Denials: If denied, you can escalate to a data protection authority or consumer regulator.
For Organizations
  • Locating Data: Data may be spread across multiple systems—maintain a data inventory for quick retrieval.
  • Balancing Privacy & Security: Only share data after verifying identity; redact info about others if needed.
  • Volume of Requests: Automate tracking and responses where possible; train staff to recognize requests quickly.
  • Deadline Pressure: Communicate early if delays arise and document the reason.

Consumer Checklist: Before You Submit a Data Rights Request

  • ✓ Have you identified the correct contact or privacy email?
  • ✓ Do you know which right you want to exercise (access, delete, correct, etc)?
  • ✓ Is your identifying information included (email, account ID)?
  • ✓ Are you prepared to offer identity verification if asked?
  • ✓ Have you saved a copy of your request?

Organization Checklist: Ensuring Compliance

  • ✓ Is there a standardized process for receiving and logging requests?
  • ✓ Are staff trained to handle requests and deadlines?
  • ✓ Do you verify identity before sharing personal data?
  • ✓ Is your data inventory up to date for quick retrieval?
  • ✓ Are all requests and outcomes documented for audit?

Frequently Asked Questions: Data Rights Requests in 2025

Submit an access request (often called a Data Subject Access Request or DSAR) by contacting the company via their privacy policy page or official contact. They are required to provide a copy of all personal data they hold about you, along with details of how it’s used and shared. Review our privacy policy to understand what data is collected and why.

Companies must have a valid legal reason to deny a request (like national security or another person’s privacy). They must explain the reason for refusal. If you believe your request was wrongly denied, you can escalate to a data protection authority (under GDPR) or a consumer protection office (under CCPA). Keep records of all communication.

Most privacy laws require companies to respond within 30 to 45 days, though extensions are possible for complex requests. If a company needs more time, they must inform you of the delay and the reason. Document all dates and communication for your records.

Yes, under laws like GDPR and CCPA, you can request deletion of personal data (“right to be forgotten”). However, companies may retain certain information for legal or contractual obligations. If deletion is refused, they must explain why. Always specify clearly what data or accounts you want deleted.

Data portability lets you request your information in a structured, machine-readable format (such as CSV or JSON), so you can transfer it to another service. This is useful if you’re switching providers or consolidating accounts. Not all regions require this right, but it is a core GDPR feature.

Organizations can request reasonable proof of identity to ensure they do not disclose your data to someone else. This may include asking for photo ID, account numbers, or confirming details you’ve previously provided. They should not ask for unnecessary or excessive documentation.

If you don’t receive a response within the required timeframe, follow up with the company using your original request as reference. If you are still ignored, you have the right to file a complaint with a data protection authority (EU) or relevant regulator (US/California). Always keep a record of your correspondence.

Recap: Stay Informed & Proactive About Data Rights

In 2025, understanding and exercising your data rights is essential for protecting your privacy and digital identity. Whether you’re a consumer requesting access or deletion, or an organization managing requests, a clear, proactive approach ensures compliance and builds trust. For more information, see our privacy policy, or explore our in-depth guide to email compliance for additional best practices.