What are my rights over my personal data, and how do I exercise them?
In the EU the rights are set out in the GDPR: access, rectification, erasure, restriction, portability and objection, exercised by a request to the controller, who answers within one month. In the United States there is no federal equivalent, so the rights follow state law, and California grants access, deletion, correction and opt-out of sale or sharing.
This answer differs by jurisdiction — see EU, US, SE, NO and DE below.
The answer per jurisdiction
EU
Articles 15 to 22 of the GDPR give access, rectification, erasure, restriction, portability and objection. The controller answers within one month, free of charge, and a refusal must be reasoned and carry a route of complaint.
Regulation (EU) 2016/679 · Europeiska unionens publikationsbyråUnited States
No federal statute. California grants access, deletion, correction and opt-out of sale or sharing, with a response deadline of 45 days and a right to appeal a refusal in several other states.
Cal. Civ. Code § 1798.100 · California Legislative CounselSweden
The GDPR applies directly. The Swedish supplementing Act adds national limits, and complaints are handled by the Authority for Privacy Protection.
SFS 2018:218 · Sveriges riksdagNorway
The GDPR applies through the Personal Data Act. The same rights, the same deadline, and the Data Protection Authority as supervisor.
LOV-2018-06-15-38 · LovdataGermany
The GDPR applies directly. The Federal Data Protection Act narrows access and erasure in defined cases, and supervision sits with the state authorities.
BDSG 2018 · Bundesministerium der Justiz
Sources
- Article 15: the right to a copy of the data and to the purposes, recipients and retention period.
- Article 17: erasure where the data is no longer necessary, consent is withdrawn or processing is unlawful.
- Article 12: one month to answer, extendable by two months for complex requests, and reasons for any refusal.
What it means for the company
Keep one intake route for requests, log the date received, and answer within the deadline of the jurisdiction the requester sits in, not the one your company sits in.
| Jurisdiction | Requirement | Source |
|---|---|---|
| EU | Six rights, answer within one month | Regulation (EU) 2016/679 |
| United States | State law only, 45 days in California | Cal. Civ. Code § 1798.100 |
| Sweden | GDPR plus national limits in the supplementing Act | SFS 2018:218 |
| Norway | GDPR through the Personal Data Act | LOV-2018-06-15-38 |
| Germany | GDPR with narrowed access under the Federal Act | BDSG 2018 |
What it means for the individual
Send the request in writing to the controller, name the right you rely on, and note the date. A refusal must be reasoned and can be taken to the supervisory authority.
Sources
- General Data Protection RegulationRegulation (EU) 2016/679 · Europeiska unionens publikationsbyrå · read 2026-08-24 · proof 0abaeaa883579e3dOfficial source
- California Consumer Privacy Act, as amended by CPRACal. Civ. Code § 1798.100 · California Legislative Counsel · read 2026-08-24 · proof 0abaeaa883579e3dOfficial source
- Swedish Act supplementing the GDPRSFS 2018:218 · Sveriges riksdag · read 2026-08-24 · proof 0abaeaa883579e3dOfficial source
- Norwegian Personal Data ActLOV-2018-06-15-38 · Lovdata · read 2026-08-24 · proof 0abaeaa883579e3dOfficial source
- German Federal Data Protection ActBDSG 2018 · Bundesministerium der Justiz · read 2026-08-24 · proof 0abaeaa883579e3dOfficial source
Next step
Compare the deadlines in the table below before you set one internal service level, because 30 days in the EU and 45 days in California are not the same clock.
The page reports what the sources say, with identifier and address to the publisher. It is not legal advice and does not assess an individual matter.
Next step
Three ways to put the register to work in your own practice.
Start with your task
Litigation
Find support in a judgment
Search guiding decisions, see what became final and follow changes in the law.
In-house, deals
Map the rules in a transaction
Move from theme to act and on to the article that carries the duty.
Compliance
Assess the risk in a process
Risk scoring per legal area, with the sources behind every score.