Law / Frameworks / NIST Privacy Framework / Control-P

NIST Privacy Framework, Control-PCT.DM-P4

Data elements can be accessed for deletion.NIST Privacy Framework, version 1.0, January 2020, CT.DM-P4

We read each law below as bearing on this control. That does not mean the control, done well, meets the law: what each law asks is on its own page. Corpus as of .

21
laws
21
places
0
with court rulings behind them
2
not yet in force
1
proposed, not law

The same ground elsewhere linked through the kinds of duty both controls are mapped from

A law in force is unmarked; the rest wear their state: not yet in force proposed

  • Andorra
  • Belarus
  • Burkina Faso
  • Côte d'Ivoire
  • Democratic Republic of the Congo
  • El Salvador
  • Ethiopia
  • France
  • Gambia
  • Kosovo
  • Monaco
  • Montenegro
  • Nicaragua
  • Niger
  • Nigeria
  • North Macedonia
  • Puerto Rico
  • Rwanda
  • Serbia
  • Spain
  • Ukraine

Data subject rights

20 laws, 20 places
PlaceLawWhat it asks, as read here
Andorra LQPD, rights of the data subject

Erase personal data on request without undue delay where it is no longer necessary, consent is withdrawn with no other lawful basis, the data subject objects with no overriding ground, it was processed unlawfully, a legal obligation requires erasure, or it was collected under the child information-society-service consent rule, and de-reference it if you operate a search engine indexing it.

Belarus Law of the Republic of Belarus On Personal Data Protection, rights of the personal data subject

Terminate processing of a personal data subject's personal data, including erasing it, within fifteen days of a demand made in the absence of a legal basis for the processing, or, where erasure is not technically possible, restrict further processing instead, under Article 13.

Burkina Faso Personal Data Protection Law, rights of the data subject

Remove, on request, personal data about a person's past private life that was collected and made public on a website, whether or not it is indexed by a search engine.

Côte d'Ivoire Law No. 2013-450 on the Protection of Personal Data, rights of the data subject

Erase a person's personal data and end its distribution on request, including data made available while they were a minor, where it is no longer necessary, where consent is withdrawn, where the processing lacks a legal ground, or for another legitimate reason, and tell every third party the data were disclosed to that removal is sought.

Democratic Republic of the Congo Digital Code, Title III, rights of the data subject

Erase personal data on request within thirty days where it is no longer necessary, was unlawfully processed, or the data subject withdrew consent with no other legal basis remaining, and where you had made the data public, take reasonable technical steps to tell any third party processing it that erasure was requested.

El Salvador Ley para la Protección de Datos Personales, rights of data subjects

Erase a data subject's personal data without undue delay on request, including the right to be forgotten reaching search engine results and other data holders, subject only to this Law's listed exceptions.

Ethiopia Personal Data Protection Proclamation, rights of data subjects

Erase personal data on request, free of charge and without excessive delay, where it is no longer necessary for its purpose, where consent is withdrawn and no other ground applies, where the data subject objects and no overriding legitimate ground exists, or where it was processed unlawfully, and take reasonable steps to tell third parties processing data you made public.

France Loi 78-17 Articles 48 and 51 II, Rights of Minors in France

On request, erase without delay personal data you collected in offering an information society service from a person who was a minor in France when you collected it, and take reasonable steps, technical ones included, to tell any controller you passed it to that the person asked for erasure of any link to, copy or reproduction of it, under Loi n. 78-17 Article 51 II.

Gambia Personal Data Protection and Privacy Act, 2025, rights of the data subject from a date not yet set

Delete personal data on request where it is no longer necessary for the purpose you collected it for, where consent is withdrawn, or where the processing is unlawful.

Kosovo Law No. 06/L-082 on Protection of Personal Data, rights of the data subject

Erase personal data on request without undue delay where it is no longer necessary, consent is withdrawn with no other lawful basis, the data subject objects with no overriding ground, it was processed unlawfully, a legal obligation requires erasure, or it was collected under the child information-society-service consent rule.

Show the other 10 laws
Monaco Loi sur la Protection des Données Personnelles, droits de la personne concernée

Erase personal data without delay on request in the listed cases, such as withdrawn consent with no other legal basis, a successful objection, data no longer necessary for its purpose, unlawfully processed data, or data collected from a minor for an information society service, and tell any third party you disclosed it to that it must be erased too.

Montenegro Law on Personal Data Protection, rights of the data subject from a date not yet set

Erase personal data that was not obtained from the data subject directly within 30 days of a request to do so, under Article 11.

Erase personal data whose processing does not comply with the law on the data subject's request, and notify the data subject and any recipient of an alteration, supplementing or erasure within 8 days, under Article 23.

Nicaragua Ley No. 787, Ley de Protección de Datos Personales, rights of data subjects

On a data subject's request, suppress and cancel their personal data from a social network, browser, or server, and, once your contractual relationship with them ends, suppress and cancel the personal data you collected during it.

Niger Loi n° 2022-59, droits des personnes concernées

Erase a person's data on request where consent is withdrawn, the processing purpose has lapsed, the processing is unlawful, or the data concerns a minor, unless a listed retention ground applies.

Nigeria Nigeria Data Protection Act, 2023, rights of a data subject

Erase personal data on request where it is no longer necessary for its original purpose, where consent was the lawful basis and has been withdrawn, where the data subject objects to processing founded on legitimate interest and no overriding ground exists, where it is processed for direct marketing and the data subject objects, where it was processed unlawfully, or where a legal ruling or obligation requires erasure.

North Macedonia Law on Personal Data Protection (LPDP), rights of the data subject

Once Chapter III takes effect, erase personal data within 30 days of a request under Article 21 wherever one of its listed grounds applies.

Rwanda Law relating to the Protection of Personal Data and Privacy, rights of the data subject

Erase a data subject's personal data on request where it is no longer necessary, consent has been withdrawn, they object, or it was unlawfully processed, and tell any third party you disclosed it to, or posted it publicly, that erasure was requested.

Serbia Law on Personal Data Protection, rights of the data subject

Erase a person's personal data without undue delay once it is no longer necessary for its purpose, consent is withdrawn with no other ground, the person objects with no overriding ground, it was processed unlawfully, or erasure is required by law.

Spain LOPDGDD Título III and Título X, Data-Subject and Digital Rights

Honor a Spanish right-to-be-forgotten request against a search-engine or social-network service under LOPDGDD Articles 93-94, distinct from and beyond the general GDPR erasure right.

Ukraine Draft Law No. 8153, data subject rights proposed

Once enacted, give a data subject in Ukraine the right to erasure of their personal data.

Sensitive categories

1 law, 1 place
PlaceLawWhat it asks, as read here
Puerto Rico Ley para la Protección de la Privacidad Cibernética de los Niños y Jóvenes (children's online privacy)

Delete a minor user's account, or their personal information at a parent's or guardian's request, within forty-five calendar days of the request.

Full text of the NIST Privacy Framework, public domain (a US government work). Every control of the framework.