You have more rights
than you are using.
Companies holding your data are legally required to tell you what they have, and in most of the world to delete it when you ask. Almost nobody asks. Here is what you can demand, where you live, and what happens if they say no.
The five above have law you can use today, yourself, free — the pages below show you how. The two marked planned are what we hope to reach next.
United States
CCPA, CPRA, and a patchwork of state laws
In California, Colorado, Connecticut, Virginia and a growing list of other states you can require a company to tell you what it holds about you, delete it, and stop selling it. Outside those states there is no general right, which is why the state you live in matters more here than anywhere else in the world.
45 days, extendable once to 90.
Most large brokers comply nationwide rather than check your address, because checking costs more than complying. Ask as though you are covered.
Your state Attorney General. California also allows a private right of action for breaches specifically.
United Kingdom
UK GDPR and the Data Protection Act 2018
A Subject Access Request gets you everything a company holds about you. Erasure under Article 17 makes them delete it. Objection under Article 21 stops them processing it for marketing, with no balancing test — for direct marketing the objection is absolute.
One month, extendable to three for complex requests. It is free.
The ICO takes complaints seriously and companies know it. Mentioning that you will escalate is often enough.
The Information Commissioner's Office at ico.org.uk. Complaining costs nothing.
European Union
GDPR, in all 27 member states
The strongest data rights in the world. Access under Article 15, erasure under Article 17, objection under Article 21, and portability under Article 20. These apply to any company processing your data, wherever that company is based.
One month, extendable to three. Free unless the request is manifestly excessive.
Fines reach 4% of global annual turnover. No other regime has teeth like it, and companies behave accordingly.
Your national Data Protection Authority. You can complain in your own country and your own language.
Canada
PIPEDA, and Law 25 in Quebec
Access to what a company holds, and correction of anything wrong. PIPEDA's deletion right is weaker than Europe's — it is closer to a right to withdraw consent, after which they must stop using it.
30 days under PIPEDA.
Law 25 is significantly stronger and includes a genuine right to erasure and to data portability. Quebec residents should cite Law 25, not PIPEDA.
The Office of the Privacy Commissioner of Canada, or the Commission d'accès à l'information in Quebec.
Australia
The Privacy Act 1988 and the Australian Privacy Principles
Access under APP 12 and correction under APP 13. Australia has no general right to erasure, which is the honest gap — but APP 11.2 requires an organisation to destroy or de-identify information it no longer needs, and that is the clause to cite.
30 days, and they may charge a reasonable access fee — though not for making the request itself.
The 2024 reforms strengthened enforcement considerably. Serious invasions of privacy are now actionable.
The Office of the Australian Information Commissioner at oaic.gov.au.
What SOVRAN does with this
Right now, nothing automatic — and we would rather say so than imply otherwise. Everything above is what you can do yourself today, free, without us.
What we are building is the part that is tedious rather than difficult: sending these requests to several hundred companies, in the format each one demands, chasing the ones that ignore you, and checking months later when a record quietly reappears. Every request producing a dated receipt you keep.
Nothing on this page is legal advice. It is a starting point, and the regulators listed will each tell you more, free.