Exercising Your Data Rights: A RAJA89 Guide

The Rights You Can Actually Use

Data protection law is not abstract. It gives you a small number of named rights that a company holding your data has to answer, on a clock, in writing. The details differ by country, but the shape is remarkably consistent wherever modern privacy law applies.

• Access. Ask what they hold, why, where it came from and who else received it.
• Correction. Have inaccurate data fixed, and in some jurisdictions have incomplete data completed.
• Deletion. Have it erased where there is no overriding reason to keep it.
• Objection. Stop certain processing, including in most places direct marketing. Objection to marketing is close to absolute.
• Portability. Receive what you gave them in a structured, machine-readable format - and in some jurisdictions have it sent to another provider.
• Withdrawal of consent, where consent was the basis. It must be as easy to withdraw as it was to give.
• Restriction. Have processing paused while a dispute about accuracy or lawfulness is resolved.
• Non-discrimination. Exercising a right must not cost you a worse price or service.

Two practical facts decide whether any of this works. First, a request has to go to the right recipient - the controller, meaning the organisation that decides why and how your data is processed, not a support queue that will close the ticket. Second, it has to name the right and identify you well enough to be actionable, without handing over more than necessary.

EU and UK Rights Under the GDPR

Under the General Data Protection Regulation, as retained in UK law, the core rights are set out in Articles 15 to 22.

• Article 15 - access. A copy of your personal data, plus the purposes, categories, recipients, retention period, the source of the data, and whether automated decision-making is involved.
• Article 16 - rectification. Inaccurate data corrected without undue delay.
• Article 17 - erasure. The "right to be forgotten", available where the data is no longer needed, consent was withdrawn with no other basis, an objection succeeded, or processing was unlawful. It is not absolute: legal obligations, freedom of expression and public-interest grounds can override it.
• Article 18 - restriction. Processing paused while accuracy or lawfulness is contested.
• Article 20 - portability. Data you provided, in a structured, commonly used, machine-readable format, where processing rests on consent or contract.
• Article 21 - objection. Stop processing based on legitimate interests or public interest, and stop direct marketing outright and unconditionally.
• Article 22 - automated decisions. Protection against decisions made solely by automated means that produce legal or similarly significant effects.

The clock is one month from receipt, extendable by two further months for complex requests, and the extension must be explained with reasons. The response is free, and refusal or delay opens the door to a complaint with the national supervisory authority - the Information Commissioner's Office in the UK, and the equivalent body in each EU member state - and to a judicial remedy.

A point that matters in practice: the regulator is a backstop rather than a helpdesk. Its leverage is the threat of investigation, so a complaint is most effective when the company's failure is clear and documented.

California: Know, Delete, Correct, Opt Out

The California Consumer Privacy Act, as amended by the CPRA, gives residents a related but differently shaped set of rights.

• Know what categories and specific pieces of personal information have been collected, and who received it.
• Delete personal information, subject to exceptions.
• Correct inaccurate personal information.
• Opt out of the sale or sharing of personal information, and limit the use and disclosure of sensitive personal information.
• Not be discriminated against for exercising these rights - no worse price or service.

The clocks differ from Europe and are worth diarising: the business must acknowledge receipt within 10 business days, respond substantively within 45 calendar days, and may extend once by a further 45 days with notice. Opt-out requests must be honoured within 15 business days. A right-to-know response reaches back twelve months, and for data collected since 1 January 2022 you can request the full history unless doing so would be disproportionately effortful.

Two mechanisms make this tractable rather than a full-time hobby.

• An authorised agent - a friend, a lawyer or a paid service - can submit requests on your behalf with signed permission. The business may still verify you directly, and it may refuse an agent who cannot prove authorisation.
• The Global Privacy Control is a browser or extension setting that sends a do-not-sell-or-share signal with every request. California treats it as a valid opt-out, which replaces hundreds of banner clicks. Its limits are real: it applies per browser and per device, it does not follow a logged-in account, and businesses outside the law's scope ignore it. See hardening your browser for where to switch it on.

California also runs a central platform, DROP, that lets residents send deletion and opt-out requests to participating businesses from one place. It is worth checking whether the companies you care about participate before writing each of them individually.

Indonesia: Law 27 of 2022

For readers in Indonesia, the governing instrument is Undang-Undang Nomor 27 Tahun 2022 tentang Pelindungan Data Pribadi (Law No. 27 of 2022 on Personal Data Protection), which replaced a patchwork of sectoral rules with a single framework.

It recognises a comparable set of data subject rights: to obtain information about the processing and the identity of the parties involved, to access and obtain a copy of one's personal data, to request correction or erasure, to withdraw consent, to object to automated decision-making, to restrict processing, to port data to another controller, and to bring a claim for compensation.

Two operational points matter for a reader trying to use it:

• There are deadlines attached to requests, and controllers are expected to respond within them rather than at their convenience. State the deadline in your request and keep the date you sent it.
• The implementing regulation arrived later than the statute, so transitional arrangements governed parts of the framework during its early application. Before relying on a specific procedural step, check the current status with the ministry responsible and with the relevant sectoral regulator, because practice has been settling rather than fixed.

Where a controller is outside Indonesia, jurisdiction can be awkward and the practical leverage is often the foreign law that also applies to it - which is an argument for sending the request under every regime that covers the company, not just the one closest to you.

Writing a Request That Cannot Be Stalled

Most requests fail for procedural reasons rather than legal ones. A useful template has six parts.

1. Identify yourself with the identifiers the company can match - the account email address, and any account or customer number. Do not attach a passport scan in the first message.
2. Name the right and the instrument. "Under Article 15 GDPR, I request access to my personal data" or "Under the CCPA, I request to know the categories and specific pieces of personal information you have collected about me". Naming the article moves the message from a support conversation to a legal request.
3. State the scope precisely: the period, the account, the categories of processing, and whether you want the recipients and retention periods as well as the content.
4. Specify the response format - a machine-readable export where portability applies.
5. State the deadline and the date you are counting from.
6. State what happens next: that you will complain to the named supervisory authority if the deadline passes, and that you are keeping the correspondence.

Send it to the controller's privacy or data protection officer address, which is usually published in the privacy policy under a heading like "how to contact us" or "your rights". Keep everything in writing and keep the timestamps. A record of a missed regulatory deadline is far more useful than a record of a frustrating phone call.

Refusing disproportionate verification

Companies are entitled to verify that you are who you say you are, especially before deleting data or disclosing sensitive categories. They are not entitled to a full identity document to answer a marketing objection. If verification feels disproportionate, ask what specific data point they are trying to match and offer the minimum that answers it. When you do send a document, redact everything that is not the identifier they asked for - a common mistake is sending an unredacted scan that adds a new copy of your ID to their systems.

When a Company Can Lawfully Refuse

Refusals are common and not always wrong. The grounds worth recognising:

• Legal retention duties. Tax, accounting, financial and employment records must be kept for set periods, and deletion requests cannot override them.
• Legitimate interest or legal claims. Data may be kept to defend or bring a legal claim, or to prevent fraud.
• Freedom of expression and journalism. Relevant to some access requests against publishers.
• Manifestly unfounded or excessive requests. Repeated requests, or an obvious attempt to burden the organisation. A fee or a refusal is then permitted - and this is the one place where a careless, duplicated request strategy actively hurts you.
• Someone else's rights. A record may contain another person's data, which can be redacted rather than disclosed.

How to escalate

1. Ask for the specific basis in writing. A refusal that cites no article is often a first-line response rather than a considered legal position.
2. Narrow the request. A broad access request is easy to refuse as excessive; a precise one is not.
3. Complain to the supervisory authority named in your jurisdiction - the ICO in the UK, the relevant member-state authority in the EU, the attorney general or the state privacy agency in California, and the ministry or supervisory body designated under Indonesian law. Complaints are free.
4. Keep the file. Complaint forms ask for dates and evidence, and a tidy correspondence trail is what makes them quick to decide.

Data Brokers, People-Search Sites and Search Results

The companies most people have never heard of hold the most about them. Data brokers assemble profiles from public records, loyalty schemes, warranty registrations, app data and purchased datasets, then sell access to employers, insurers, marketers and investigators. People-search sites publish a subset to the open web: your name, approximate age, former addresses, relatives and phone numbers.

Several jurisdictions now run a central route rather than requiring one request per company. California's DROP platform is the clearest example. Where you have to go directly:

1. Find the major brokers operating in your country. Regulators have published lists, and the largest ones maintain their own opt-out pages.
2. Use the opt-out and deletion routes they publish, and do not accept a "suppression" that only hides the record from public search while leaving the underlying profile intact. Ask explicitly for deletion.
3. Expect to repeat the exercise. Profiles get rebuilt from new public records and fresh data purchases. A quarterly pass on the worst offenders is more effective than one heroic effort.
4. Separately, protect against the residual. Lock down your credit file or your country's equivalent, because a broker profile is the raw material for impersonation rather than the harm itself.

De-indexing search results

Removing a page from a search index is a different action from deleting it at source. A de-indexing request removes it from results; the page itself remains, and another search engine may still show it. Where a result is genuinely harmful - personal information exposed, or material that is outdated and no longer in the public interest - the search engine's own removal process and, in some jurisdictions, the right to erasure are the routes. Document the specific URLs and the harm; general complaints about a name are rarely actioned.

What to Expect, and Where to Spend the Effort

A first access response is usually a dense, badly labelled bulk export rather than a report, and asking what particular fields mean is a normal follow-up rather than a sign you did something wrong. Deletion clears live systems while backups are overwritten on their own cycle - ask what that schedule is instead of assuming instant erasure. Opting out of sale stops the onward flow, not the company's own collection, and no right overrides a genuine legal duty to keep records.

Budget about an hour per organisation, plus a reminder, and prioritise rather than trying to be thorough:

• Accounts holding health, financial, employment or precise location data.
• Brokers republishing your address, phone number and family relationships.
• Anyone generating marketing you never asked for, where an unconditional objection to direct marketing is the fastest available win.

Five companies that matter beat fifty that do not. And to work out who is likely to hold data about you in the first place, start with how online tracking works, which describes the routes by which your data leaves your device.

Questions readers ask about this page

Back to top ↑