Data Protection: What Companies Must Tell You
Data protection regimes in many countries give individuals enforceable rights over information organisations hold about them, and place obligations on those organisations to explain what they do with it.
What they must tell you
Privacy notices should explain what data is collected, why, on what legal basis, who it is shared with, how long it is kept, and what rights you have.
A notice that is vague about sharing or retention is a reasonable prompt to ask directly.
The main rights
Access: obtaining a copy of the personal data held about you. Usually free, with a response deadline commonly around one month.
Rectification: having inaccurate data corrected.
Erasure: having data deleted in defined circumstances. Not absolute — organisations can retain data where they have a legal obligation or other lawful ground.
Objection and restriction: particularly to direct marketing, where the right to object is generally absolute and must be honoured.
Portability: receiving data in a machine-readable format in some circumstances.
Rights relating to automated decision-making, including profiling with significant effects.
Making an access request
A written request identifying yourself and what you are seeking. It does not need to be in any particular form or cite legislation, though doing so makes the nature of the request clear.
Be specific if you want particular records, since a broad request may produce a large and unhelpful volume.
Organisations may verify your identity before responding, which is legitimate.
Exemptions apply — legal privilege, others' personal data, and certain investigative contexts among them — so some material may be withheld or redacted.
Marketing
Rules on electronic marketing generally require consent or a limited existing-customer exception, with an opt-out in every message.
Opt-out requests must be honoured promptly. Continuing contact after an opt-out is a straightforward complaint.
Preference services exist in many countries for telephone and postal marketing.
Data breaches
Organisations generally must notify regulators of significant breaches within a short deadline, and must inform affected individuals where there is high risk to them.
If notified, act: change passwords, enable multi-factor authentication, monitor accounts, and consider a credit file check where financial data was involved.
Complaining
Complain to the organisation first, then to the national data protection authority, which can investigate and enforce.
Complaints are free and do not require a lawyer. Provide the correspondence and a clear account of what you requested and what happened.
This article is general information and not legal advice. Data protection law varies by jurisdiction.
Article Was Generated By AI.