--- title: "Data subject rights — Global Regulatory Comparison | Data Protection Monitor" canonical: https://dataprotection.gi/domains/data-subject-rights/ source_html: /domains/data-subject-rights/index.html description: "Cross-jurisdiction comparison of Data subject rights across 167 markets in Data Protection Monitor." generated_at: 2026-10-25T04:46:50Z content_sha256: 9ef6d124674e6d341883aa72f511243fd29456d549eb9c438699c977797d504f generator: "fe-fleet/md-twin@1.0" --- # Data subject rights — Global Regulatory Comparison | Data Protection Monitor ## Jurisdiction Readings (167 markets) 50 Confirmed 67 Probable 50 Uncertain Jurisdiction Region Status Regulatory Summary Actions [African bloc](/jurisdictions/african-bloc/) (AFR) Africa Red No continental-level data-subject-rights framework (access, rectification, erasure, restriction, portability, deadlines) was evidenced in the Malabo Convention treaty index, status list, or Roadmap… [Profile →](/jurisdictions/african-bloc/)[Brief](/reports/?t=entry&j=AFR) [Alabama, USA](/jurisdictions/alabama-usa/) (US-AL) Americas Amber Sources confirm the Alabama Personal Data Protection Act grants residents 'various data rights' with AG enforcement, but granular right-by-right text (access, rectification/erasure… [Profile →](/jurisdictions/alabama-usa/)[Brief](/reports/?t=entry&j=US-AL) [Alaska, USA](/jurisdictions/alaska-usa/) (US-AK) Americas Red Alaska law does not grant a general access, rectification, erasure, restriction, objection, or portability right over personal data held by private-sector businesses. The only individual-facing… [Profile →](/jurisdictions/alaska-usa/)[Brief](/reports/?t=entry&j=US-AK) [Alberta, Canada](/jurisdictions/alberta-canada/) (CA-AB) Americas Amber PIPA grants individuals a right of access to personal information held by organizations and corresponding correction rights, but currently lacks a codified data-portability right; the OIPC has called… [Profile →](/jurisdictions/alberta-canada/)[Brief](/reports/?t=entry&j=CA-AB) [Algeria](/jurisdictions/algeria/) (DZ) Africa Red Francophone-model statutes of this generation (which appear to have shaped 18-07) typically grant rights of access, rectification, and objection; an explicit GDPR-style erasure/portability right is… [Profile →](/jurisdictions/algeria/)[Brief](/reports/?t=entry&j=DZ) [Antigua and Barbuda](/jurisdictions/antigua-and-barbuda/) (AG) Caribbean Red No Antigua-specific source located on access, rectification/erasure, restriction/objection, portability, or statutory response deadlines. Regional comparators located (Barbados draft bill, Saint… [Profile →](/jurisdictions/antigua-and-barbuda/)[Brief](/reports/?t=entry&j=AG) [Argentina](/jurisdictions/argentina/) (AR) Americas Green Data subjects currently hold rights of information, access, rectification, updating, erasure and consent-withdrawal, enforceable through the constitutionally-entrenched 'habeas data' judicial remedy.… [Profile →](/jurisdictions/argentina/)[Brief](/reports/?t=entry&j=AR) [Arizona, USA](/jurisdictions/arizona-usa/) (US-AZ) Americas Red Arizona confers no general statutory rights of access, rectification, erasure, restriction, objection or portability over personal data held by private-sector businesses. Such rights exist only where… [Profile →](/jurisdictions/arizona-usa/)[Brief](/reports/?t=entry&j=US-AZ) [Arkansas, USA](/jurisdictions/arkansas-usa/) (US-AR) Americas Red Arkansas confers no general consumer rights of access, rectification, erasure, restriction, objection, or data portability with respect to personal data held by private-sector controllers. The only… [Profile →](/jurisdictions/arkansas-usa/)[Brief](/reports/?t=entry&j=US-AR) [Asia-Pacific bloc](/jurisdictions/asia-pacific-bloc/) (APAC) Asia-Pacific Red No bloc-level statutory data-subject-rights framework (access, rectification, erasure, restriction, objection, portability, or response-window deadlines) exists. The Global CBPR Privacy Principles… [Profile →](/jurisdictions/asia-pacific-bloc/)[Brief](/reports/?t=entry&j=APAC) [Australia](/jurisdictions/australia/) (AU) Asia-Pacific Amber Individuals have access and correction rights under the APPs, a portability right via the Consumer Data Right (CDR), and an opt-out right for direct marketing. A general 'right to be… [Profile →](/jurisdictions/australia/)[Brief](/reports/?t=entry&j=AU) [Austria](/jurisdictions/austria/) (AT) Europe Green GDPR Articles 15-22 apply directly in Austria; DSB enforcement decisions and CJEU references (notably Case C-416/23 on 'excessive requests' and various DSB portability/erasure/access decisions)… [Profile →](/jurisdictions/austria/)[Brief](/reports/?t=entry&j=AT) [Bangladesh](/jurisdictions/bangladesh/) (BD) Asia-Pacific Red Secondary academic commentary characterises the Ordinance as establishing 'rights-oriented' mechanisms for data subjects, but specific rights (access, rectification/erasure, restriction/objection… [Profile →](/jurisdictions/bangladesh/)[Brief](/reports/?t=entry&j=BD) [Belgium](/jurisdictions/belgium/) (BE) Europe Green Belgium follows the GDPR data-subject-rights catalogue (access, rectification/erasure, restriction/objection, portability) with the standard one-month response deadline. The Belgian DPA is… [Profile →](/jurisdictions/belgium/)[Brief](/reports/?t=entry&j=BE) [Belize](/jurisdictions/belize/) (BZ) Americas Amber The 2024 reform Bill confirms a rectification right modelled closely on GDPR-style drafting. No sourced text on access, erasure, restriction/objection, portability, or statutory response deadlines… [Profile →](/jurisdictions/belize/)[Brief](/reports/?t=entry&j=BZ) [Brazil](/jurisdictions/brazil/) (BR) Americas Green Article 18 grants a GDPR-like bundle of rights (confirmation/access, correction, anonymisation/blocking/deletion, portability, information about sharing and about consequences of refusing consent… [Profile →](/jurisdictions/brazil/)[Brief](/reports/?t=entry&j=BR) [British Columbia, Canada](/jurisdictions/british-columbia-canada/) (CA-BC) Americas Amber PIPA provides individuals a right of access to their own personal information held by an organization and a right to request correction of inaccurate or incomplete information. PIPA does not… [Profile →](/jurisdictions/british-columbia-canada/)[Brief](/reports/?t=entry&j=CA-BC) [Bulgaria](/jurisdictions/bulgaria/) (BG) Europe Green Data subjects exercise GDPR Chapter III rights directly; CPDP supplements this with public-facing right-of-access awareness materials, and Article 25k of the Act sets a national retention rule (six… [Profile →](/jurisdictions/bulgaria/)[Brief](/reports/?t=entry&j=BG) [Cambodia](/jurisdictions/cambodia/) (KH) Asia-Pacific Red The draft LPDP proposes a GDPR-familiar suite of data-subject rights, but these carry no current legal force since the law has not been enacted. No existing Cambodian statute grants a general… [Profile →](/jurisdictions/cambodia/)[Brief](/reports/?t=entry&j=KH) [Cameroon](/jurisdictions/cameroon/) (CM) Africa Red Available sources reference the establishment of a Data Protection Authority tasked with protecting individuals' rights and freedoms with respect to processing, implying baseline data subject rights… [Profile →](/jurisdictions/cameroon/)[Brief](/reports/?t=entry&j=CM) [Canada — Kahnawake](/jurisdictions/canada-kahnawake/) (CA-KAH) Americas Amber PIPEDA's Schedule 1 gives individuals rights of access and to challenge accuracy, without a fixed statutory response deadline in the federal Act itself. Quebec's Private Sector Act imposes a concrete… [Profile →](/jurisdictions/canada-kahnawake/)[Brief](/reports/?t=entry&j=CA-KAH) [Canada — Tobique First Nation](/jurisdictions/canada-tobique-first-nation/) (CA-TFN) Americas Amber Individuals have a right of access and to challenge accuracy (Principle 4.9), with a strict 30-day statutory response deadline (s.8(3)), a single 30-day extension option with mandatory notice… [Profile →](/jurisdictions/canada-tobique-first-nation/)[Brief](/reports/?t=entry&j=CA-TFN) [Chile](/jurisdictions/chile/) (CL) Americas Amber Ley 21.719 expands the classic ARCO (access, rectification, cancellation, opposition) rights into an ARCOP+ scheme: access, rectification, suppression (renamed from cancellation), opposition… [Profile →](/jurisdictions/chile/)[Brief](/reports/?t=entry&j=CL) [China](/jurisdictions/china/) (CN) Asia-Pacific Amber PIPL Chapter IV grants a GDPR-adjacent rights bundle: access/copy, rectification, erasure, restriction/objection (including a right to demand explanation of and refute automated decisions), and a… [Profile →](/jurisdictions/china/)[Brief](/reports/?t=entry&j=CN) [Colombia](/jurisdictions/colombia/) (CO) Americas Amber Law 1581 enumerates access, rectification, update and deletion rights, and Decree 1377 requires controllers to maintain a process for responding to data-subject queries and claims. No explicit… [Profile →](/jurisdictions/colombia/)[Brief](/reports/?t=entry&j=CO) [Colorado, USA](/jurisdictions/colorado-usa/) (US-CO) Americas Green Colorado consumers hold access, correction, deletion, portability, and opt-out rights (targeted advertising, sale, and consequential-effect profiling), plus a mandatory appeal right against… [Profile →](/jurisdictions/colorado-usa/)[Brief](/reports/?t=entry&j=US-CO) [Comoros](/jurisdictions/comoros/) (KM) Africa Red No subject-access, rectification, erasure, restriction, objection or portability framework was located for the Union of the Comoros in any searched source; no statutory response-deadline regime was… [Profile →](/jurisdictions/comoros/)[Brief](/reports/?t=entry&j=KM) [Comoros — Anjouan](/jurisdictions/comoros-anjouan/) (KM-A) Africa Red No statutory subject-access, rectification/erasure, restriction/objection, portability right, or statutory response-deadline framework could be identified for Comoros/Anjouan. [Profile →](/jurisdictions/comoros-anjouan/)[Brief](/reports/?t=entry&j=KM-A) [Comoros — Mohéli](/jurisdictions/comoros-moheli-mwali/) (KM-M) Africa Red No statutory subject-access, rectification/erasure, restriction/objection, portability, or response-deadline framework exists for Comoros/Mohéli. [Profile →](/jurisdictions/comoros-moheli-mwali/)[Brief](/reports/?t=entry&j=KM-M) [Connecticut, USA](/jurisdictions/connecticut-usa/) (US-CT) Americas Green CTDPA grants CT consumers rights of access, correction, deletion, portability, and opt-out of targeted advertising/sale/certain profiling, plus an appeal right against controller denials. Controllers… [Profile →](/jurisdictions/connecticut-usa/)[Brief](/reports/?t=entry&j=US-CT) [Costa Rica](/jurisdictions/costa-rica/) (CR) Americas Amber Law No. 8968 grants data subjects rights of access, rectification and deletion, plus a right to revoke consent; a pending bill (No. 23097) would add data portability and an opt-out right, and a… [Profile →](/jurisdictions/costa-rica/)[Brief](/reports/?t=entry&j=CR) [Croatia](/jurisdictions/croatia/) (HR) Europe Green Data-subject rights follow GDPR Articles 13-22 directly. Croatia's principal derogation excuses state statistical bodies from certain rights where compliance would impair statistical functions, and… [Profile →](/jurisdictions/croatia/)[Brief](/reports/?t=entry&j=HR) [Curaçao](/jurisdictions/curacao/) (CW) Caribbean Red No Curaçao-specific detail on access, rectification/erasure, restriction/objection, portability, or statutory response deadlines was retrieved in this research pass; the underlying Ordinance text is… [Profile →](/jurisdictions/curacao/)[Brief](/reports/?t=entry&j=CW) [Cyprus](/jurisdictions/cyprus/) (CY) Europe Green Data subject rights (access, rectification, erasure, restriction, objection, portability) follow GDPR Arts 15-22 directly, enforced by the Commissioner. A published Article 60 decision demonstrates… [Profile →](/jurisdictions/cyprus/)[Brief](/reports/?t=entry&j=CY) [Czech Republic](/jurisdictions/czech-republic/) (CZ) Europe Green GDPR governs data subject rights directly in Czechia (access, rectification, erasure, restriction, objection, portability), supplemented by Act No. 110/2019 Coll., whose Title III carves out… [Profile →](/jurisdictions/czech-republic/)[Brief](/reports/?t=entry&j=CZ) [Delaware, USA](/jurisdictions/delaware-usa/) (US-DE) Americas Green The DPDPA grants Delaware consumers access, correction, deletion, portability, and opt-out (sale/targeted-advertising/profiling) rights, with a free access request permitted once every 12 months and… [Profile →](/jurisdictions/delaware-usa/)[Brief](/reports/?t=entry&j=US-DE) [Denmark](/jurisdictions/denmark/) (DK) Europe Green Denmark applies GDPR's data-subject-rights framework (Arts 12-22) directly, with no material derogation identified for access, rectification/erasure, restriction, objection, portability, or response… [Profile →](/jurisdictions/denmark/)[Brief](/reports/?t=entry&j=DK) [District of Columbia, USA](/jurisdictions/district-of-columbia-usa/) (US-DC) Americas Red The District confers no general statutory rights of access, rectification, erasure, restriction, objection, or portability. These rights exist only where an applicable federal sectoral statute (e.g.… [Profile →](/jurisdictions/district-of-columbia-usa/)[Brief](/reports/?t=entry&j=US-DC) [Dominican Republic](/jurisdictions/dominican-republic/) (DO) Americas Amber Law 172-13 is rooted in the constitutional habeas data tradition and is expected to afford data subjects access, rectification and objection-style rights; however, granular statutory deadlines, an… [Profile →](/jurisdictions/dominican-republic/)[Brief](/reports/?t=entry&j=DO) [Ecuador](/jurisdictions/ecuador/) (EC) Americas Green EUDPR Arts 14-24 grant EUI data subjects rights of information, access, rectification, erasure, restriction, portability and objection, with a general one-month response deadline (extendable by two… [Profile →](/jurisdictions/ecuador/)[Brief](/reports/?t=entry&j=EC) [Egypt](/jurisdictions/egypt/) (EG) Africa Amber The PDPL grants GDPR-analogous data-subject rights: rectification/erasure/update, purpose-limitation/restriction, and objection to processing where a violation exists. Distinct access-right scope… [Profile →](/jurisdictions/egypt/)[Brief](/reports/?t=entry&j=EG) [Estonia](/jurisdictions/estonia/) (EE) Europe Green Estonia applies the GDPR's Chapter III rights directly (access, rectification, erasure, restriction, objection, portability), with the standard one-month (extendable) response window under Art 12(3).… [Profile →](/jurisdictions/estonia/)[Brief](/reports/?t=entry&j=EE) [European Economic Area](/jurisdictions/european-economic-area-bloc/) Expert reviewed (EEA) Europe Amber GDPR Chapter III rights (access, rectification, erasure, restriction, objection, portability) remain fully in force EEA-wide. The EDPB's 2025 Coordinated Enforcement Framework focused on the right to… [Profile →](/jurisdictions/european-economic-area-bloc/)[Brief](/reports/?t=entry&j=EEA) [Finland](/jurisdictions/finland/) (FI) Europe Green Finland applies the GDPR Chapter III data subject rights (Articles 12-22) directly, with no material national derogation identified. Enforcement activity demonstrates active policing of the access… [Profile →](/jurisdictions/finland/)[Brief](/reports/?t=entry&j=FI) [Florida, USA](/jurisdictions/florida-usa/) (US-FL) Americas Amber FDBR-covered controllers must honour access, correction, deletion, portability and opt-out rights, subject to a 45-day (extendable to 60-day) response window and a mandatory appeals process. Rights… [Profile →](/jurisdictions/florida-usa/)[Brief](/reports/?t=entry&j=US-FL) [France](/jurisdictions/france/) (FR) Europe Amber GDPR Articles 15-22 rights apply fully, including to processing nominally exempt from consent (e.g., audience measurement). CNIL has reinforced minors' erasure rights and equal-ease-of-refusal… [Profile →](/jurisdictions/france/)[Brief](/reports/?t=entry&j=FR) [Georgia, USA](/jurisdictions/georgia-usa/) (US-GA) Americas Red Georgia confers no general consumer rights of access, rectification, erasure, restriction, objection, or portability over personal data held by private-sector controllers. Any such rights that exist… [Profile →](/jurisdictions/georgia-usa/)[Brief](/reports/?t=entry&j=US-GA) [Germany](/jurisdictions/germany/) (DE) Europe Green The full GDPR rights catalogue (access, rectification, erasure, restriction, objection, portability) applies directly, with BfDI publishing detailed procedural guidance (e.g., on Art 15… [Profile →](/jurisdictions/germany/)[Brief](/reports/?t=entry&j=DE) [Ghana](/jurisdictions/ghana/) (GH) Africa Amber The Act establishes a right to object to processing (including direct marketing) and to restrict processing, broadly paralleling GDPR concepts, but does not provide a specific erasure right in the… [Profile →](/jurisdictions/ghana/)[Brief](/reports/?t=entry&j=GH) [Gibraltar](/jurisdictions/gibraltar/) Expert reviewed (GI) Europe Amber Data subject rights are inherited from the GDPR structure (Arts 12-22). GRA's published enforcement/investigations reports evidence real-world exercise of the access right, including failures by… [Profile →](/jurisdictions/gibraltar/)[Brief](/reports/?t=entry&j=GI) [Greece](/jurisdictions/greece/) (GR) Europe Green GDPR Articles 12-22 apply directly. HDPA enforcement activity demonstrates active protection of the access right in particular; erasure was the subject of a 2025 EDPB Coordinated Enforcement… [Profile →](/jurisdictions/greece/)[Brief](/reports/?t=entry&j=GR) [Guernsey](/jurisdictions/guernsey/) (GG) Europe Amber The Law confers a GDPR-equivalent suite of data subject rights (information, access, portability, rectification, erasure, restriction, objection, notification of rectification/erasure/restriction… [Profile →](/jurisdictions/guernsey/)[Brief](/reports/?t=entry&j=GG) [Guernsey — Alderney](/jurisdictions/guernsey-alderney/) (GG-ALD) Europe Green Part III of the Law confers rights modelled on GDPR Arts 13-22, including rights to information (direct and indirect collection), access, portability, objection (direct marketing is an absolute… [Profile →](/jurisdictions/guernsey-alderney/)[Brief](/reports/?t=entry&j=GG-ALD) [Hawaii, USA](/jurisdictions/hawaii-usa/) (US-HI) Americas Red Hawaii confers no general statutory rights of access, rectification, erasure, restriction, objection, or portability over personal data. Such rights exist only indirectly through federal sectoral law… [Profile →](/jurisdictions/hawaii-usa/)[Brief](/reports/?t=entry&j=US-HI) [Hong Kong](/jurisdictions/hong-kong/) (HK) Asia-Pacific Amber PDPO grants access and correction rights with a 40-calendar-day statutory response window, but does not provide a general right to erasure/be forgotten, nor a data-portability right. Objection-type… [Profile →](/jurisdictions/hong-kong/)[Brief](/reports/?t=entry&j=HK) [Hungary](/jurisdictions/hungary/) (HU) Europe Amber Access, rectification/erasure, restriction/objection are all evidenced through NAIH enforcement practice. Portability carries no HU-specific derogation identified. Response-deadline obligations… [Profile →](/jurisdictions/hungary/)[Brief](/reports/?t=entry&j=HU) [Iceland](/jurisdictions/iceland/) (IS) Europe Green Access, rectification/erasure, restriction/objection, and portability rights apply per GDPR Arts. 13-22 via Act No. 90/2018, subject to a research-purpose carve-out under Article 18(1) of the Act; no… [Profile →](/jurisdictions/iceland/)[Brief](/reports/?t=entry&j=IS) [Idaho, USA](/jurisdictions/idaho-usa/) (US-ID) Americas Red Idaho grants no general consumer rights of access, rectification, erasure, restriction, objection, or portability. The only rights-adjacent federal overlay applicable to Idaho residents in the… [Profile →](/jurisdictions/idaho-usa/)[Brief](/reports/?t=entry&j=US-ID) [Illinois, USA](/jurisdictions/illinois-usa/) (US-IL) Americas Red Illinois has no general statutory access, rectification, erasure, restriction, objection, or portability rights. The closest analogues are BIPA's mandatory destruction/retention-schedule duty and… [Profile →](/jurisdictions/illinois-usa/)[Brief](/reports/?t=entry&j=US-IL) [India](/jurisdictions/india/) (IN) Asia-Pacific Amber Data principals are granted a narrower set of codified rights than under GDPR/CCPA: access, correction, erasure ('completion'), grievance redressal, and the right to nominate a representative. There… [Profile →](/jurisdictions/india/)[Brief](/reports/?t=entry&j=IN) [Indiana, USA](/jurisdictions/indiana-usa/) (US-IN) Americas Green Indiana consumers hold access, correction, deletion, portability, opt-out and opt-in (sensitive data) rights modeled closely on the Virginia CDPA. Controllers must respond within 45 days, extendable… [Profile →](/jurisdictions/indiana-usa/)[Brief](/reports/?t=entry&j=US-IN) [Iowa, USA](/jurisdictions/iowa-usa/) (US-IA) Americas Amber The ICDPA provides four core consumer rights (access, deletion, portability, opt-out of sale) but deliberately omits a right to rectification and an automated-decision-making opt-out found in most… [Profile →](/jurisdictions/iowa-usa/)[Brief](/reports/?t=entry&j=US-IA) [Ireland](/jurisdictions/ireland/) (IE) Europe Amber GDPR Articles 13-22 provide the framework for access, rectification, erasure, restriction, objection and portability rights, enforced in Ireland by the DPC. The DPC's 2024 case-study reporting… [Profile →](/jurisdictions/ireland/)[Brief](/reports/?t=entry&j=IE) [Isle of Man](/jurisdictions/isle-of-man/) (IM) Europe Green The Manx Information Commissioner has directly enforced data subject access rights (Applied GDPR Articles 12 and 15) against both a government department (2020) and the publicly-owned healthcare… [Profile →](/jurisdictions/isle-of-man/)[Brief](/reports/?t=entry&j=IM) [Italy](/jurisdictions/italy/) (IT) Europe Green Garante enforcement gives operative content to Arts.12 and 15-22 GDPR, requiring an adequate and timely response to rights requests, sanctioning controllers (including via formal admonishment) for… [Profile →](/jurisdictions/italy/)[Brief](/reports/?t=entry&j=IT) [Ivory Coast](/jurisdictions/ivory-coast-uemoa-bloc/) (CI) Africa Red No CI-specific primary or secondary evidence on the subject-access, rectification/erasure, restriction/objection, portability, or response-deadline framework under Law No. 2013-450 was retrieved in… [Profile →](/jurisdictions/ivory-coast-uemoa-bloc/)[Brief](/reports/?t=entry&j=CI) [Japan](/jurisdictions/japan/) (JP) Asia-Pacific Green Data subjects hold rights to demand disclosure, correction/addition/deletion, and cessation of use or third-party provision of 'retained personal data.' The 2020/2022 amendments broadened these… [Profile →](/jurisdictions/japan/)[Brief](/reports/?t=entry&j=JP) [Jersey](/jurisdictions/jersey/) (JE) Europe Amber Practitioner commentary confirms Jersey's DSAR response window is shorter than the GDPR's one-month standard, but the precise day-count was not retrieved from primary legislation. Erasure… [Profile →](/jurisdictions/jersey/)[Brief](/reports/?t=entry&j=JE) [Kansas, USA](/jurisdictions/kansas-usa/) (US-KS) Americas Red Kansas confers no general statutory rights of access, rectification, erasure, restriction, objection, or portability on consumers with respect to personal data held by private-sector businesses. The… [Profile →](/jurisdictions/kansas-usa/)[Brief](/reports/?t=entry&j=US-KS) [Kazakhstan](/jurisdictions/kazakhstan/) (KZ) Asia-Pacific Amber Confirmed data-subject rights are limited to the right to be informed and the right to rectify, set out in the 2020 MDAI Rules. A right to erasure appears only in unenacted draft amendments… [Profile →](/jurisdictions/kazakhstan/)[Brief](/reports/?t=entry&j=KZ) [Kentucky, USA](/jurisdictions/kentucky-usa/) (US-KY) Americas Green The KCDPA grants Kentucky consumers a standard Virginia-model rights bundle: confirmation of processing, access, correction, deletion, portability, and opt-out of targeted advertising/sale/certain… [Profile →](/jurisdictions/kentucky-usa/)[Brief](/reports/?t=entry&j=US-KY) [Kenya](/jurisdictions/kenya/) (KE) Africa Amber The Act provides data subject rights but with less procedural detail than the GDPR. Enforcement practice (e.g. the Platinum Credit and Nairobi Hospital decisions) shows the ODPC actively enforcing… [Profile →](/jurisdictions/kenya/)[Brief](/reports/?t=entry&j=KE) [Laos](/jurisdictions/laos/) (LA) Asia-Pacific Red No comprehensive, GDPR-analogue data-subject-rights framework (access, rectification/erasure, restriction/objection, portability, statutory response deadlines) was identified for Laos in available… [Profile →](/jurisdictions/laos/)[Brief](/reports/?t=entry&j=LA) [Latin America bloc](/jurisdictions/latin-america-bloc/) (LATAM) Americas Amber OAS Principles articulate access, rectification and erasure/objection rights in general terms. RIPD's 2026 update strengthens the objection right in the ADM context (human intervention). Portability… [Profile →](/jurisdictions/latin-america-bloc/)[Brief](/reports/?t=entry&j=LATAM) [Latvia](/jurisdictions/latvia/) (LV) Europe Green Data subject rights in Latvia derive directly from GDPR Chapter III (Articles 12-23), supplemented by the Personal Data Processing Law. DVI's 2019 enforcement action against an online retailer for… [Profile →](/jurisdictions/latvia/)[Brief](/reports/?t=entry&j=LV) [Liechtenstein](/jurisdictions/liechtenstein/) (LI) Europe Green Data subject rights (access, rectification, erasure, restriction, objection, portability) follow GDPR Articles 15-22 directly, with the DSS issuing practical guidance on access requests… [Profile →](/jurisdictions/liechtenstein/)[Brief](/reports/?t=entry&j=LI) [Lithuania](/jurisdictions/lithuania/) (LT) Europe Green Data subject rights follow GDPR Arts. 15-22 directly. VDAI enforcement against Vinted (access/erasure) and against Vilnius Municipality (accuracy/rectification) demonstrates active application of… [Profile →](/jurisdictions/lithuania/)[Brief](/reports/?t=entry&j=LT) [Louisiana, USA](/jurisdictions/louisiana-usa/) (US-LA) Americas Amber Once effective (2027-01-01), the LDPA grants access, correction, deletion, portability, and opt-out rights typical of the Virginia/Colorado model. Louisiana Data Privacy Act… [Profile →](/jurisdictions/louisiana-usa/)[Brief](/reports/?t=entry&j=US-LA) [Luxembourg](/jurisdictions/luxembourg/) (LU) Europe Amber CNPD's own enforcement record evidences the operative rights framework: the Amazon Europe Core decision (16 July 2021) expressly found violations of Articles 15 (access), 16 (rectification), 17… [Profile →](/jurisdictions/luxembourg/)[Brief](/reports/?t=entry&j=LU) [Maine, USA](/jurisdictions/maine-usa/) (US-ME) Americas Red Maine confers no general access, rectification, erasure, restriction/objection, or portability rights. The only codified subject right is the ISP customer's right to revoke previously given consent… [Profile →](/jurisdictions/maine-usa/)[Brief](/reports/?t=entry&j=US-ME) [Malaysia](/jurisdictions/malaysia/) (MY) Asia-Pacific Amber The PDPA's Division 4 (ss.30-37) establishes a right of access and a right to correct personal data, underpinned by the Access Principle (s.12). The 2024 Amendment Act adds a new right to data… [Profile →](/jurisdictions/malaysia/)[Brief](/reports/?t=entry&j=MY) [Malta](/jurisdictions/malta/) (MT) Europe Green Data subject rights (access, rectification, erasure, restriction, objection, portability) apply directly under GDPR Articles 12-22 with no Malta-specific narrowing identified. The IDPC has issued… [Profile →](/jurisdictions/malta/)[Brief](/reports/?t=entry&j=MT) [Marshall Islands](/jurisdictions/marshall-islands/) (MH) Asia-Pacific Red No subject-access, rectification/erasure, restriction/objection, portability, or statutory response-deadline framework exists in RMI law, as there is no general data-processing statute. Searched for… [Profile →](/jurisdictions/marshall-islands/)[Brief](/reports/?t=entry&j=MH) [Maryland, USA](/jurisdictions/maryland-usa/) (US-MD) Americas Amber MODPA grants Maryland consumers access, correction, deletion, and portability rights, plus opt-outs from targeted advertising, sale, and certain profiling, with a mandatory controller-side appeal… [Profile →](/jurisdictions/maryland-usa/)[Brief](/reports/?t=entry&j=US-MD) [Massachusetts, USA](/jurisdictions/massachusetts-usa/) (US-MA) Americas Red Massachusetts confers no general access, rectification, erasure, restriction, objection, or portability rights on residents with respect to private-sector data holders. Limited, sector-specific… [Profile →](/jurisdictions/massachusetts-usa/)[Brief](/reports/?t=entry&j=US-MA) [Mexico](/jurisdictions/mexico/) (MX) Americas Amber Mexico's rights framework centers on the ARCO rights (access, rectification, cancellation, opposition). The NLFPDPPP broadens the definition of the access right to include information about the… [Profile →](/jurisdictions/mexico/)[Brief](/reports/?t=entry&j=MX) [Michigan, USA](/jurisdictions/michigan-usa/) (US-MI) Americas Red Michigan confers no general statutory rights of access, rectification, erasure, restriction, objection, or portability. No comprehensive deadline/response-window regime exists outside the… [Profile →](/jurisdictions/michigan-usa/)[Brief](/reports/?t=entry&j=US-MI) [Minnesota, USA](/jurisdictions/minnesota-usa/) (US-MN) Americas Green The MCDPA grants Minnesota consumers a materially complete rights package summarized by the AGO as 'LOCKED+': a list of third parties data was sold to, opt-out of sale/targeted-advertising/profiling… [Profile →](/jurisdictions/minnesota-usa/)[Brief](/reports/?t=entry&j=US-MN) [Mississippi, USA](/jurisdictions/mississippi-usa/) (US-MS) Americas Red Mississippi grants no state-law rights of access, rectification, erasure, restriction, objection, or portability to consumers over their personal data. Such rights only arise incidentally where a… [Profile →](/jurisdictions/mississippi-usa/)[Brief](/reports/?t=entry&j=US-MS) [Missouri, USA](/jurisdictions/missouri-usa/) (US-MO) Americas Red Missouri confers no general access, rectification, erasure, restriction/objection, or portability rights on consumers with respect to personal data. The only consumer-facing entitlement is the… [Profile →](/jurisdictions/missouri-usa/)[Brief](/reports/?t=entry&j=US-MO) [Montana, USA](/jurisdictions/montana-usa/) (US-MT) Americas Green Montanans have a right to know/access what personal data is collected and processed, correct inaccuracies, delete personal data, obtain a portable copy, and opt out of sale, targeted advertising, and… [Profile →](/jurisdictions/montana-usa/)[Brief](/reports/?t=entry&j=US-MT) [Morocco](/jurisdictions/morocco/) (MA) Africa Amber Because the Morocco-EU gap analysis singled out only the absence of a right to be forgotten and a right to data portability as divergences in data subject rights, this indicates that access… [Profile →](/jurisdictions/morocco/)[Brief](/reports/?t=entry&j=MA) [Mozambique](/jurisdictions/mozambique/) (MZ) Africa Red Beyond the general constitutional guarantee in Article 71, Mozambique has no enacted framework granting enumerated data subject rights (access, rectification, erasure, restriction, objection… [Profile →](/jurisdictions/mozambique/)[Brief](/reports/?t=entry&j=MZ) [Myanmar](/jurisdictions/myanmar/) (MM) Asia-Pacific Red No general subject-access, rectification/erasure, restriction/objection, portability, or statutory response-deadline framework was identified for data subjects in Myanmar outside the narrow… [Profile →](/jurisdictions/myanmar/)[Brief](/reports/?t=entry&j=MM) [Nebraska, USA](/jurisdictions/nebraska-usa/) (US-NE) Americas Amber The NDPA grants Nebraska consumers WPA-model rights (access, correction, deletion, portability, and opt-out of targeted advertising/sale/certain profiling), enforced solely by the AG. Precise… [Profile →](/jurisdictions/nebraska-usa/)[Brief](/reports/?t=entry&j=US-NE) [Nepal](/jurisdictions/nepal/) (NP) Asia-Pacific Red No statutory subject-access, rectification/erasure, restriction/objection, portability, or defined response-window framework equivalent to a comprehensive DP statute was located for Nepal. The… [Profile →](/jurisdictions/nepal/)[Brief](/reports/?t=entry&j=NP) [Netherlands](/jurisdictions/netherlands/) (NL) Europe Green Data subject rights in NL derive directly from GDPR Chapter III (access, rectification, erasure, restriction, objection, portability) with no material Dutch derogation. AP enforcement practice (e.g.… [Profile →](/jurisdictions/netherlands/)[Brief](/reports/?t=entry&j=NL) [Nevada, USA](/jurisdictions/nevada-usa/) (US-NV) Americas Amber Nevada does not grant a general bundle of data-subject rights (access, rectification, erasure, portability). The only individual-facing rights are (i) SB 220's right to opt out of the 'sale' of… [Profile →](/jurisdictions/nevada-usa/)[Brief](/reports/?t=entry&j=US-NV) [New Brunswick, Canada](/jurisdictions/new-brunswick-canada/) (CA-NB) Americas Red PIPEDA's access-right framework (with narrow statutory exceptions under s.9(3)) is documented, but rectification/erasure, restriction/objection, portability and statutory response-deadline specifics… [Profile →](/jurisdictions/new-brunswick-canada/)[Brief](/reports/?t=entry&j=CA-NB) [New Hampshire, USA](/jurisdictions/new-hampshire-usa/) (US-NH) Americas Green The NHDPA grants New Hampshire consumers confirmation/access, correction, deletion, portability, and opt-out rights (targeted advertising, sale, and certain automated-decision profiling), with a… [Profile →](/jurisdictions/new-hampshire-usa/)[Brief](/reports/?t=entry&j=US-NH) [New Jersey, USA](/jurisdictions/new-jersey-usa/) (US-NJ) Americas Green The NJDPL grants New Jersey consumers rights to confirm whether a controller is processing their personal data and to access it, to correct/delete data, to obtain a portable copy, and to opt out of… [Profile →](/jurisdictions/new-jersey-usa/)[Brief](/reports/?t=entry&j=US-NJ) [New Mexico, USA](/jurisdictions/new-mexico-usa/) (US-NM) Americas Red New Mexico confers no general consumer data-subject rights (access, rectification, erasure, restriction, objection, portability) at the state level. Residents' only relevant statutory rights are… [Profile →](/jurisdictions/new-mexico-usa/)[Brief](/reports/?t=entry&j=US-NM) [New Zealand](/jurisdictions/new-zealand/) (NZ) Asia-Pacific Amber Individuals have an access right (IPP6) and correction right (IPP7), with a statutory 20-working-day response window (extendable on reasonable grounds) enforceable via OPC binding access… [Profile →](/jurisdictions/new-zealand/)[Brief](/reports/?t=entry&j=NZ) [Nigeria](/jurisdictions/nigeria/) (NG) Africa Amber Part VI of the NDPA (Sections 34-38) enumerates data subject rights including general rights, withdrawal of consent, right to object, automated decision-making protections, and data portability.… [Profile →](/jurisdictions/nigeria/)[Brief](/reports/?t=entry&j=NG) [North Carolina, USA](/jurisdictions/north-carolina-usa/) (US-NC) Americas Red North Carolina confers no general subject-access, rectification, erasure, restriction/objection, or portability rights on individuals vis-à-vis private-sector data controllers. The Identity Theft… [Profile →](/jurisdictions/north-carolina-usa/)[Brief](/reports/?t=entry&j=US-NC) [North Dakota, USA](/jurisdictions/north-dakota-usa/) (US-ND) Americas Red North Dakota confers no general statutory subject-access, rectification, erasure, restriction, objection, or portability rights. Such rights as exist are narrow federal sectoral analogues (e.g., FCRA… [Profile →](/jurisdictions/north-dakota-usa/)[Brief](/reports/?t=entry&j=US-ND) [Norway](/jurisdictions/norway/) (NO) Europe Green GDPR Arts 12-22 apply directly in Norway. Enforcement decisions (SATS, Meta) demonstrate active supervision of access, erasure, and objection rights, with the right to object to profiling for… [Profile →](/jurisdictions/norway/)[Brief](/reports/?t=entry&j=NO) [Ohio, USA](/jurisdictions/ohio-usa/) (US-OH) Americas Red Ohio confers no general statutory access, rectification, erasure, restriction, objection, or portability rights on consumers with respect to commercial data processing. Such rights exist only within… [Profile →](/jurisdictions/ohio-usa/)[Brief](/reports/?t=entry&j=US-OH) [Oklahoma, USA](/jurisdictions/oklahoma-usa/) (US-OK) Americas Amber No enforceable consumer data-subject-rights framework currently exists in Oklahoma outside limited breach-notification entitlements. SB 546 will introduce standard rights (access… [Profile →](/jurisdictions/oklahoma-usa/)[Brief](/reports/?t=entry&j=US-OK) [Ontario, Canada](/jurisdictions/ontario-canada/) (CA-ON) Americas Amber PIPEDA provides an access right and a 'challenging compliance' right functioning as an implicit correction mechanism, with a 'reasonable time and minimal/no cost' response standard (Principle 4.9.4).… [Profile →](/jurisdictions/ontario-canada/)[Brief](/reports/?t=entry&j=CA-ON) [Oregon, USA](/jurisdictions/oregon-usa/) (US-OR) Americas Green OCPA grants Oregon consumers a bundle of rights DOJ summarizes with the mnemonic L.O.C.K.E.D. (List, Opt-out, Copy, Know, Edit, Delete), including a first-in-the-nation right to a list of specific… [Profile →](/jurisdictions/oregon-usa/)[Brief](/reports/?t=entry&j=US-OR) [Pakistan](/jurisdictions/pakistan/) (PK) Asia-Pacific Red No enacted subject-access, correction, erasure, objection, or portability regime exists. Draft bills propose access, correction (30-day response window per the 2021 draft), erasure (14-day window per… [Profile →](/jurisdictions/pakistan/)[Brief](/reports/?t=entry&j=PK) [Palau](/jurisdictions/palau/) (PW) Asia-Pacific Red No statutory access, rectification, erasure, restriction, objection, or portability rights, and no statutory response deadline, could be located for Palau data subjects outside of any sector-specific… [Profile →](/jurisdictions/palau/)[Brief](/reports/?t=entry&j=PW) [Panama](/jurisdictions/panama/) (PA) Americas Amber Law 81 grants data subjects rights of access, rectification, cancellation (erasure), opposition (including consent revocation), and portability. Specific statutory response-time deadlines for… [Profile →](/jurisdictions/panama/)[Brief](/reports/?t=entry&j=PA) [Pennsylvania, USA](/jurisdictions/pennsylvania-usa/) (US-PA) Americas Red No enacted PA statute grants a general set of subject-access, rectification, erasure, restriction, objection or portability rights. Federal sectoral rights (e.g., HIPAA access, GLBA opt-out) may… [Profile →](/jurisdictions/pennsylvania-usa/)[Brief](/reports/?t=entry&j=US-PA) [Peru](/jurisdictions/peru/) (PE) Americas Green Peru grants the classic ARCO rights (Acceso, Rectificación, Cancelación, Oposición) with statutory response deadlines of 20 business days for access and 10 business days for rectification… [Profile →](/jurisdictions/peru/)[Brief](/reports/?t=entry&j=PE) [Philippines](/jurisdictions/philippines/) (PH) Asia-Pacific Amber The Act enumerates data-subject rights aligned to notice, choice, access, accuracy/integrity, erasure/blocking ('right to be forgotten' analogue), and data portability. Detailed procedural mechanics… [Profile →](/jurisdictions/philippines/)[Brief](/reports/?t=entry&j=PH) [Poland](/jurisdictions/poland/) (PL) Europe Green Poland applies the GDPR Chapter III data subject rights (access, rectification, erasure, restriction, objection, portability) without national derogation. UODO enforcement precedent (ClickQuickNow)… [Profile →](/jurisdictions/poland/)[Brief](/reports/?t=entry&j=PL) [Portugal](/jurisdictions/portugal/) (PT) Europe Green Data subject rights follow the GDPR framework, with Portugal-specific limits: secrecy-duty exceptions to information/access rights, and a right-to-erasure that only becomes exercisable at the end of… [Profile →](/jurisdictions/portugal/)[Brief](/reports/?t=entry&j=PT) [Qatar](/jurisdictions/qatar/) (QA) Middle East Amber The QFC Data Protection Regulations 2021 provide a full rights suite (access, rectification, erasure, objection, restriction, portability, and a right not to be subject to solely automated… [Profile →](/jurisdictions/qatar/)[Brief](/reports/?t=entry&j=QA) [Quebec, Canada](/jurisdictions/quebec-canada/) (CA-QC) Americas Green Quebec grants GDPR-adjacent rights of access, rectification, a bespoke 'right to be forgotten' via de-indexing, contestation of automated decisions, and (as of Sept. 2024) data portability, with a… [Profile →](/jurisdictions/quebec-canada/)[Brief](/reports/?t=entry&j=CA-QC) [Rhode Island, USA](/jurisdictions/rhode-island-usa/) (US-RI) Americas Amber RIDTPPA grants Rhode Island customers rights to be informed, access, rectify, delete, port their data, and opt out of processing for targeted advertising, sale, and profiling in furtherance of solely… [Profile →](/jurisdictions/rhode-island-usa/)[Brief](/reports/?t=entry&j=US-RI) [Romania](/jurisdictions/romania/) (RO) Europe Green Data subject rights (access, rectification, erasure, restriction, objection, portability) apply per GDPR Articles 15-22 with no Romania-specific derogations identified in Law 190/2018 beyond the… [Profile →](/jurisdictions/romania/)[Brief](/reports/?t=entry&j=RO) [Russia](/jurisdictions/russia/) (RU) Europe Amber Data subjects have access, rectification and erasure rights with defined response windows (7 working days for destruction of unlawfully-obtained/unneeded data; 30 days for reasoned written responses… [Profile →](/jurisdictions/russia/)[Brief](/reports/?t=entry&j=RU) [Rwanda](/jurisdictions/rwanda/) (RW) Africa Green Chapter III of the law (Articles 23-29) enumerates a right to information, right to object, right of rectification or erasure, right to data portability, protections against solely-automated… [Profile →](/jurisdictions/rwanda/)[Brief](/reports/?t=entry&j=RW) [Saudi Arabia](/jurisdictions/saudi-arabia/) (SA) Middle East Amber The PDPL provides a GDPR-style suite of data subject rights (access, correction, deletion, restriction, objection), but the Implementing Regulation gives less granular guidance on scope and timelines… [Profile →](/jurisdictions/saudi-arabia/)[Brief](/reports/?t=entry&j=SA) [Senegal](/jurisdictions/senegal/) (SN) Africa Amber The Law provides an information duty (identity of controller, mandatory/optional nature of replies, recipients) coupled with access, rectification/erasure (Article 69), and objection rights. No… [Profile →](/jurisdictions/senegal/)[Brief](/reports/?t=entry&j=SN) [Serbia](/jurisdictions/serbia/) (RS) Europe Amber The LPDP's data-subject-rights provisions (access, rectification, erasure, restriction, objection, portability) are described by secondary legal commentary as mirroring GDPR normative provisions, but… [Profile →](/jurisdictions/serbia/)[Brief](/reports/?t=entry&j=RS) [Seychelles](/jurisdictions/seychelles/) (SC) Africa Amber The Act grants data subjects the right to be informed, access, rectification, deletion (erasure), objection to processing, data portability, and compensation. Statutory response deadlines, extension… [Profile →](/jurisdictions/seychelles/)[Brief](/reports/?t=entry&j=SC) [Singapore](/jurisdictions/singapore/) (SG) Asia-Pacific Amber Data subject rights are narrower than under GDPR. Section 21 of the PDPA allows an individual to request access to personal data held by an organization and to information… [Profile →](/jurisdictions/singapore/)[Brief](/reports/?t=entry&j=SG) [Slovakia](/jurisdictions/slovakia/) (SK) Europe Green GDPR's full data-subject rights catalogue (access, rectification, erasure, restriction, objection, portability) applies directly in Slovakia via Act 18/2018 procedural transposition. Both the GDPR and the PDPA empower data subjects with several rights, including the right to erasure, the right to be informed, the right to object, the right to data portability… [Profile →](/jurisdictions/thailand/)[Brief](/reports/?t=entry&j=TH) [Trinidad and Tobago](/jurisdictions/trinidad-and-tobago/) (TT) Caribbean Red No subject-access, erasure, restriction, objection or portability regime is currently enforceable, since Part IV of the DPA 2011 is unproclaimed. The 2024 Bill proposes a Part VIII dealing with… [Profile →](/jurisdictions/trinidad-and-tobago/)[Brief](/reports/?t=entry&j=TT) [Tunisia](/jurisdictions/tunisia/) (TN) Africa Red Tunisia's 2004 law is generally understood to include a subject-access and correction framework consistent with first-generation omnibus statutes, but the specific access, rectification/erasure… [Profile →](/jurisdictions/tunisia/)[Brief](/reports/?t=entry&j=TN) [Turkey](/jurisdictions/turkey/) (TR) Europe Amber Article 11 of the LPPD provides an access-right framework comparable to GDPR subject-access rights, consolidated procedurally by a 2018 KVKK Regulation. Erasure is operationalised primarily through… [Profile →](/jurisdictions/turkey/)[Brief](/reports/?t=entry&j=TR) [Uganda](/jurisdictions/uganda/) (UG) Africa Amber Data subjects can request correction or deletion of inaccurate, outdated, or unlawfully held data (Section 16) and may lodge complaints leading to PDPO-assigned compensation (Section 31). Rights… [Profile →](/jurisdictions/uganda/)[Brief](/reports/?t=entry&j=UG) [Ukraine](/jurisdictions/ukraine/) (UA) Europe Amber The current Law provides for general data-subject rights and a 30-day transparency deadline for third-party-sourced data, but secondary commentary indicates it lacks GDPR-equivalent granularity for… [Profile →](/jurisdictions/ukraine/)[Brief](/reports/?t=entry&j=UA) [United Arab Emirates](/jurisdictions/united-arab-emirates/) (AE) Middle East Amber The PDPL is characterized as granting GDPR-style data subject rights, though specific statutory response deadlines for federal-law subject-access or erasure requests were not confirmed in available… [Profile →](/jurisdictions/united-arab-emirates/)[Brief](/reports/?t=entry&j=AE) [United Kingdom](/jurisdictions/united-kingdom/) Expert reviewed (UK) Europe Green UK GDPR data subject rights (access, rectification, erasure, restriction, objection, portability) are preserved post-DUAA, with the DUAA adding a 'stopping the clock' mechanism allowing controllers… [Profile →](/jurisdictions/united-kingdom/)[Brief](/reports/?t=entry&j=UK) [United States](/jurisdictions/united-states/) (US) Americas Amber There is no federal statutory access/erasure/portability right of general application. State comprehensive privacy laws (19 enacted as of 2025) grant consumers rights to access, correct, and delete… [Profile →](/jurisdictions/united-states/)[Brief](/reports/?t=entry&j=US) [United States — California](/jurisdictions/united-states-california/) (US-CA) Americas Green The CCPA/CPRA provides consumers rights to know/access, delete, correct, opt out of sale/share, limit use of sensitive personal information, data portability, non-discrimination, and (as of the 2025… [Profile →](/jurisdictions/united-states-california/)[Brief](/reports/?t=entry&j=US-CA) [United States — New York](/jurisdictions/united-states-new-york/) (US-NY) Americas Red New York lacks a general consumer data-subject-rights regime (no state-wide access, rectification, erasure, restriction, objection, or portability right analogous to CPRA/GDPR). Rights that exist are… [Profile →](/jurisdictions/united-states-new-york/)[Brief](/reports/?t=entry&j=US-NY) [Uruguay](/jurisdictions/uruguay/) (UY) Americas Amber Uruguay grants a right of access to explicit and unambiguous information on the destination and purpose of stored personal data, plus rights to correction, updating, deletion, inclusion or… [Profile →](/jurisdictions/uruguay/)[Brief](/reports/?t=entry&j=UY) [Utah, USA](/jurisdictions/utah-usa/) (US-UT) Americas Amber The UCPA grants Utah consumers rights of access, deletion, portability, and opt-out of targeted advertising/sale, but notably omits a right to correct inaccurate data, a right to opt out of… [Profile →](/jurisdictions/utah-usa/)[Brief](/reports/?t=entry&j=US-UT) [Vanuatu](/jurisdictions/vanuatu/) (VU) Asia-Pacific Red Secondary commentary states the Act provides requirements for ... data subject rights generally, but statutory response deadlines, extension tests, erasure… [Profile →](/jurisdictions/vanuatu/)[Brief](/reports/?t=entry&j=VU) [Venezuela](/jurisdictions/venezuela/) (VE) Americas Red Habeas data (Article 28) grants a constitutional right to access personal data and to request correction or destruction of data that could harm the data subject; this is exercised through a… [Profile →](/jurisdictions/venezuela/)[Brief](/reports/?t=entry&j=VE) [Vermont, USA](/jurisdictions/vermont-usa/) (US-VT) Americas Amber S.71 grants a CTDPA-style rights package (access, correction, deletion, portability, opt-outs) effective 1 January 2028; no rights exist under a comprehensive statute prior to that date. [Profile →](/jurisdictions/vermont-usa/)[Brief](/reports/?t=entry&j=US-VT) [Vietnam](/jurisdictions/vietnam/) (VN) Asia-Pacific Amber The PDPL establishes a diversified set of data-subject rights (to be informed, access, correction, deletion), with Decree 356 prescribing detailed request-handling procedures. Restriction/objection… [Profile →](/jurisdictions/vietnam/)[Brief](/reports/?t=entry&j=VN) [Virginia, USA](/jurisdictions/virginia-usa/) (US-VA) Americas Green The VCDPA grants Virginia consumers access, correction, deletion, opt-out (targeted advertising/sale/profiling), and portability-adjacent rights, with a 45-day (plus one 45-day extension) response… [Profile →](/jurisdictions/virginia-usa/)[Brief](/reports/?t=entry&j=US-VA) [Washington State, USA](/jurisdictions/washington-state-usa/) (US-WA) Americas Amber Data subject rights in Washington are confined to the health-data context under MHMDA: consumers have rights to confirm/access, withdraw consent, and delete consumer health data. There is no general… [Profile →](/jurisdictions/washington-state-usa/)[Brief](/reports/?t=entry&j=US-WA) [West Virginia, USA](/jurisdictions/west-virginia-usa/) (US-WV) Americas Red West Virginia confers no statutory consumer rights of access, rectification, erasure, restriction, objection or portability. Several bills (HB 3159/2021, HB 3498/2023) that would have created such… [Profile →](/jurisdictions/west-virginia-usa/)[Brief](/reports/?t=entry&j=US-WV) [Wisconsin, USA](/jurisdictions/wisconsin-usa/) (US-WI) Americas Red Wisconsin consumers have no general statutory rights of access, rectification, erasure, restriction, objection, or portability regarding commercially held personal data. AB 466 would have created… [Profile →](/jurisdictions/wisconsin-usa/)[Brief](/reports/?t=entry&j=US-WI) [Wyoming, USA](/jurisdictions/wyoming-usa/) (US-WY) Americas Red Wyoming confers no general consumer data-subject rights (access, deletion, restriction, portability). The only rights-like structure operative in the state derives from federal FERPA (education… [Profile →](/jurisdictions/wyoming-usa/)[Brief](/reports/?t=entry&j=US-WY) [Zambia](/jurisdictions/zambia/) (ZM) Africa Amber The enacted Act is reported to cover 'the rights of data subjects,' but the specific mechanics of access, rectification/erasure, restriction/objection, portability, and statutory response deadlines… [Profile →](/jurisdictions/zambia/)[Brief](/reports/?t=entry&j=ZM)