Law / Frameworks / NIST Privacy Framework / Control-P
NIST Privacy Framework, Control-PCT.DM-P4
Data elements can be accessed for deletion.NIST Privacy Framework, version 1.0, January 2020, CT.DM-P4
We read each law below as bearing on this control. That does not mean the control, done well, meets the law: what each law asks is on its own page. Corpus as of .
- 21
- laws
- 21
- places
- 0
- with court rulings behind them
- 2
- not yet in force
- 1
- proposed, not law
The same ground elsewhere linked through the kinds of duty both controls are mapped from
- NIST AI RMFMEASURE 2.9 The AI model is explained, validated, and documented, and AI system output is...
- NIST AI RMFMEASURE 3.3 Feedback processes for end users and impacted communities to report problems and...
- NIST AI 600-1GAI-RISK-04 Data Privacy
- MIT mitigations3.2 Data Governance
- MIT mitigations4.6 User Rights & Recourse
A law in force is unmarked; the rest wear their state: not yet in force proposed
Data subject rights
20 laws, 20 places| Place | Law | What it asks, as read here |
|---|---|---|
| LQPD, rights of the data subject |
Erase personal data on request without undue delay where it is no longer necessary, consent is withdrawn with no other lawful basis, the data subject objects with no overriding ground, it was processed unlawfully, a legal obligation requires erasure, or it was collected under the child information-society-service consent rule, and de-reference it if you operate a search engine indexing it. |
|
| Law of the Republic of Belarus On Personal Data Protection, rights of the personal data subject |
Terminate processing of a personal data subject's personal data, including erasing it, within fifteen days of a demand made in the absence of a legal basis for the processing, or, where erasure is not technically possible, restrict further processing instead, under Article 13. |
|
| Personal Data Protection Law, rights of the data subject |
Remove, on request, personal data about a person's past private life that was collected and made public on a website, whether or not it is indexed by a search engine. |
|
| Law No. 2013-450 on the Protection of Personal Data, rights of the data subject |
Erase a person's personal data and end its distribution on request, including data made available while they were a minor, where it is no longer necessary, where consent is withdrawn, where the processing lacks a legal ground, or for another legitimate reason, and tell every third party the data were disclosed to that removal is sought. |
|
| Digital Code, Title III, rights of the data subject |
Erase personal data on request within thirty days where it is no longer necessary, was unlawfully processed, or the data subject withdrew consent with no other legal basis remaining, and where you had made the data public, take reasonable technical steps to tell any third party processing it that erasure was requested. |
|
| Ley para la Protección de Datos Personales, rights of data subjects |
Erase a data subject's personal data without undue delay on request, including the right to be forgotten reaching search engine results and other data holders, subject only to this Law's listed exceptions. |
|
| Personal Data Protection Proclamation, rights of data subjects |
Erase personal data on request, free of charge and without excessive delay, where it is no longer necessary for its purpose, where consent is withdrawn and no other ground applies, where the data subject objects and no overriding legitimate ground exists, or where it was processed unlawfully, and take reasonable steps to tell third parties processing data you made public. |
|
| Loi 78-17 Articles 48 and 51 II, Rights of Minors in France |
On request, erase without delay personal data you collected in offering an information society service from a person who was a minor in France when you collected it, and take reasonable steps, technical ones included, to tell any controller you passed it to that the person asked for erasure of any link to, copy or reproduction of it, under Loi n. 78-17 Article 51 II. |
|
| Personal Data Protection and Privacy Act, 2025, rights of the data subject from a date not yet set |
Delete personal data on request where it is no longer necessary for the purpose you collected it for, where consent is withdrawn, or where the processing is unlawful. |
|
| Law No. 06/L-082 on Protection of Personal Data, rights of the data subject |
Erase personal data on request without undue delay where it is no longer necessary, consent is withdrawn with no other lawful basis, the data subject objects with no overriding ground, it was processed unlawfully, a legal obligation requires erasure, or it was collected under the child information-society-service consent rule. |
Show the other 10 laws
| Loi sur la Protection des Données Personnelles, droits de la personne concernée |
Erase personal data without delay on request in the listed cases, such as withdrawn consent with no other legal basis, a successful objection, data no longer necessary for its purpose, unlawfully processed data, or data collected from a minor for an information society service, and tell any third party you disclosed it to that it must be erased too. |
|
| Law on Personal Data Protection, rights of the data subject from a date not yet set |
Erase personal data that was not obtained from the data subject directly within 30 days of a request to do so, under Article 11. Erase personal data whose processing does not comply with the law on the data subject's request, and notify the data subject and any recipient of an alteration, supplementing or erasure within 8 days, under Article 23. |
|
| Ley No. 787, Ley de Protección de Datos Personales, rights of data subjects |
On a data subject's request, suppress and cancel their personal data from a social network, browser, or server, and, once your contractual relationship with them ends, suppress and cancel the personal data you collected during it. |
|
| Loi n° 2022-59, droits des personnes concernées |
Erase a person's data on request where consent is withdrawn, the processing purpose has lapsed, the processing is unlawful, or the data concerns a minor, unless a listed retention ground applies. |
|
| Nigeria Data Protection Act, 2023, rights of a data subject |
Erase personal data on request where it is no longer necessary for its original purpose, where consent was the lawful basis and has been withdrawn, where the data subject objects to processing founded on legitimate interest and no overriding ground exists, where it is processed for direct marketing and the data subject objects, where it was processed unlawfully, or where a legal ruling or obligation requires erasure. |
|
| Law on Personal Data Protection (LPDP), rights of the data subject |
Once Chapter III takes effect, erase personal data within 30 days of a request under Article 21 wherever one of its listed grounds applies. |
|
| Law relating to the Protection of Personal Data and Privacy, rights of the data subject |
Erase a data subject's personal data on request where it is no longer necessary, consent has been withdrawn, they object, or it was unlawfully processed, and tell any third party you disclosed it to, or posted it publicly, that erasure was requested. |
|
| Law on Personal Data Protection, rights of the data subject |
Erase a person's personal data without undue delay once it is no longer necessary for its purpose, consent is withdrawn with no other ground, the person objects with no overriding ground, it was processed unlawfully, or erasure is required by law. |
|
| LOPDGDD Título III and Título X, Data-Subject and Digital Rights |
Honor a Spanish right-to-be-forgotten request against a search-engine or social-network service under LOPDGDD Articles 93-94, distinct from and beyond the general GDPR erasure right. |
|
| Draft Law No. 8153, data subject rights proposed |
Once enacted, give a data subject in Ukraine the right to erasure of their personal data. |
Sensitive categories
1 law, 1 place| Place | Law | What it asks, as read here |
|---|---|---|
| Ley para la Protección de la Privacidad Cibernética de los Niños y Jóvenes (children's online privacy) |
Delete a minor user's account, or their personal information at a parent's or guardian's request, within forty-five calendar days of the request. |
Full text of the NIST Privacy Framework, public domain (a US government work). Every control of the framework.