Data subject rights
Data subject rights are the rights privacy laws give individuals over their personal data, such as access, correction, erasure, portability and objection, which organizations must honor within fixed deadlines.Articles 15 to 22 of the GDPR list them: the right of access (15), to rectification (16), to erasure (17), to restriction of processing (18), the controller's duty to notify recipients of these changes (19), the right to data portability (20), the right to object (21), including an unconditional right to object to direct marketing, and the right not to be subject to a decision based solely on automated processing with legal or similarly significant effects (22). Article 12(3) sets the deadline: without undue delay and within one month of the request, extendable by two further months for complex or numerous requests. Responses are free unless requests are manifestly unfounded or excessive.
California's CCPA gives consumers the rights to know and access, to delete, to correct, to opt out of the sale or sharing of their data, to limit the use of sensitive personal information, and not to be retaliated against for using them. Businesses have 45 days to respond, extendable once by 45 days with notice.
Cookies are part of the scope. A visitor can ask what a site's trackers collected, ask for erasure of their consent records, or object to marketing, and the privacy policy must say how. The usual entry point is a DSAR; erasure has its own entry under right to erasure.