NIST Privacy Framework, Control-PCT.PO-P3

Honour a data subject's right to object to automated decision-making.

Honour a data subject's rights to access, rectification, erasure, restriction, portability, and objection to direct marketing.

Stop processing personal data for the purposes of direct marketing as soon as the data subject asks you to, with no ground for refusing.

Give a personal data subject, on request and within five working days, information on the processing of their personal data, including your identity, confirmation of processing, the data and its source, and the legal basis and purposes, or explain why you refuse, under Article 11, and rectify personal data that are incomplete, outdated or inaccurate on request.

Require a personal data subject exercising an Article 10 to 13 right to submit a written or electronic application under Article 14, and respond in the same form the application was made unless the subject asks otherwise.

Give a person in Belgium a path to obtain human intervention, express their view, and contest a decision made solely by automated processing that produces a legal or similarly significant effect on them.

Honor a person's request to access, rectify, erase, restrict, port, or object to processing of their personal data in Belgium within one month of receipt.

Respond to a data subject's request to access, rectify, or object to the processing of their personal data, and pass on any correction to any third party the data was disclosed to.

Let a data subject object at any time, on legitimate grounds, to the processing of their personal data, and let them object free of charge and without any justification to processing for direct marketing, charitable, or political prospecting.

Correct, block, erase or destroy personal information on written request where it contains an error or omission.

Let a person know, object to, and obtain the deletion or rectification of personal data about them that your records or databases hold, when that data affects their right to personal or family privacy, image, honour, or reputation.

Answer a request for access, rectification, erasure, restriction, or portability under Articles 17 to 22, and notify any recipient the data were disclosed to of a rectification, erasure or restriction you make.

Stop processing personal data for direct marketing purposes as soon as a person objects, under Article 23.

Act on a data subject's request to rectify, erase, restrict the processing of, port, or object to the processing of their personal data, and inform the data subject of the outcome without undue delay and, in any event, within one month of receipt of the request, extendable by up to two further months with the Commission's approval.

Let a data subject confirm that processing exists, access their data, correct it, or have it anonymized, blocked, deleted, or ported to another provider, on request.

Tell a data subject which public and private entities you shared their data with, let them object to processing carried out under a consent exemption where it violates this law, and let them revoke consent at any time through a free and easy procedure.

Brunei's Personal Data Protection Order 2025 has granted an individual a right to access personal data an organisation holds about them, including a voiceprint or faceprint, and a right to have inaccurate personal data corrected, since these rights (Part 5) took effect 1 January 2026 under Government Gazette No. S 11/2025. The Order names no separate deletion or data-portability right.

Give a person in Bulgaria a path to obtain human intervention, express their view, and contest a decision made solely by automated processing that produces a legal or similarly significant effect on them.

Honor a person's request to access, rectify, erase, restrict, port, or object to processing of their personal data in Bulgaria within one month of receipt.

Accept a rights request from a person in Bulgaria made in writing, electronically, or through an action in your product's interface once the person is identified, under Personal Data Protection Act Articles 37b and 37v.

Stop processing a person's data on their objection for legitimate reasons, unless you can show an overriding legitimate ground for the processing that outweighs their rights.

Rectify, complete, update, lock or erase personal data at a data subject's written request within two months, notify any third party the data was disclosed to, and carry the burden of proof if you dispute the request.

Let a data subject object on request and free of charge to processing for direct marketing or other prospecting, and object without cost to a first disclosure to third parties for those purposes or to use on behalf of third parties.

Let a data subject object at any time, on compelling legitimate grounds relating to their particular situation, to processing you carry out for a public interest or legitimate interest ground, and stop unless you show overriding compelling legitimate grounds or the processing serves a legal claim.

Provide a California consumer a verifiable way to request access to, deletion of, correction of, and a portable copy of their personal information, and respond within the CCPA's statutory timeline.

Honor a Global Privacy Control signal or another recognized opt-out preference signal as a valid request to opt out of the sale or sharing of personal information.

A data controller must give a data subject the information article 27 lists before processing their personal data, and must act on a request to access, rectify, erase, restrict, receive in a portable form, or object to the processing of their personal data, generally within one month of the request.

A data controller must honor a data subject's objection to the processing of their personal data where it is used entirely for direct marketing purposes, a right the draft makes absolute.

Get a person's prior consent before contacting them with direct marketing by phone, fax, SMS, email, instant message, or social network, and let them unsubscribe or change their preferences at any time.

Give every marketing communication, including one sent to a business or a professional contact, a notice and an unsubscribe mechanism as simple and effective as the original sign up.

Honor a data subject's objection, made on legitimate grounds, to processing of their personal data, including before first communicating it to a third party or using it for prospecting.

Within one month of a written request, rectify, complete, update, block, or erase personal data that is inaccurate, incomplete, equivocal, outdated, or unlawfully held.

Offer a non-personalized option or a convenient opt-out wherever automated decision-making is used to push marketing or commercial information.

Provide an explanation and honor an individual's refusal of a decision made solely by automated means where that decision has a major effect on their rights.

Provide a convenient channel for individuals to access, copy, correct, or delete their personal information, and to request portability to another handler where state conditions are met.

Give a reasoned written explanation whenever a rights request is refused.

Give a data subject the right to know, update and rectify their personal data, request proof of the authorization given, be told on request how their data has been used, revoke the authorization or seek deletion where the processing violates their constitutional or statutory rights, and access their personal data free of charge.

Mark the record with a pending claim legend within two business days of receiving a complete claim for correction, updating or deletion, and resolve the claim within fifteen business days, or fifteen days extendable by eight more days with notice of the delay and a new resolution date.

Put in place pertinent, efficient and demonstrable strategies for an artificial intelligence system to guarantee the data subject rights that Ley 1266 de 2008 and Ley 1581 de 2012 and their implementing decrees establish.

Let a data subject object, on legitimate grounds, to the processing of their personal data.

Let a data subject object, free of charge and without needing to state a reason, to their personal data being used for commercial, charitable or political prospecting.

Give a Connecticut consumer a means to confirm whether you process their personal data, access it, correct it, delete it, and receive a portable copy.

Offer a Connecticut consumer an opt-out of targeted advertising, sale, and profiling in furtherance of decisions with legal or similarly significant effects, and honor a universal opt-out preference signal.

Give a person in Croatia a path to obtain human intervention, express their view, and contest a decision made solely by automated processing that produces a legal or similarly significant effect on them.

Honor a person's request to access, rectify, erase, restrict, port, or object to processing of their personal data in Croatia within one month of receipt.

Honor a person's request to access, rectify, erase, restrict, port, or object to processing of their personal data in Cyprus within one month of receipt.

Give a person in the Czech Republic a path to obtain human intervention, express their view, and contest a decision made solely by automated processing that produces a legal or similarly significant effect on them.

Honor a person's request to access, rectify, erase, restrict, port, or object to processing of their personal data in the Czech Republic within one month of receipt.

Stop processing a person's data for prospecting purposes as soon as they object, free of charge, and tell them before their data are first disclosed to a third party for prospecting so they can object to that disclosure.

Rectify, complete, update, delete or lock personal data on request where it is inaccurate, incomplete, ambiguous or outdated, including at the request of a deceased person's successors.

Give a Delaware consumer a means to confirm whether you process their personal data, access it, correct it, delete it, and receive a portable copy.

Offer a Delaware consumer an opt-out of targeted advertising, sale, and profiling in furtherance of decisions with legal or similarly significant effects, and honor universal opt-out preference signals as of January 1, 2026. Until December 31, 2026 the profiling opt-out reaches only solely-automated decisions; from January 1, 2027 it reaches automated decisions.

Let a data subject object at any time, on legitimate grounds, to processing of their data, offer them that right expressly and free of charge before their data is first communicated to a third party or used for prospecting, and answer an objection within thirty days.

Do not charge a data subject for supplying information or acting on a request, and tell them in writing within thirty days if you do not act on their request.

Honor a person's request to access, rectify, erase, restrict, port, or object to processing of their personal data within one month of receipt, for a person in Denmark.

Correct, update, or suppress inaccurate, incomplete, or outdated personal data on a data subject's request, free of charge, within ten business days of the request or of discovering the error, and notify any recipient the data was disclosed to within five business days of the correction.

Recognize a data subject's independent rights of access, rectification, cancellation, and opposition, and their right to bring a judicial habeas data action to learn of, access, correct, or suppress personal data, without requiring one right to be exercised before another.

Answer a data subject's request for information, access, rectification, updating, erasure, objection, portability or suspension of the processing on the terms articles 12 to 19 set.

Guarantee the data subject's rights under the LOPDP, and access to the mechanisms for exercising them, where an AI system processes the data subject's personal data; a processor owes this only where it has access to, visibility of, or effective control over that data.

Give a Data Subject, on request, access to their own Personal Data you hold, and let them withdraw consent to its retention or processing, correct, edit, delete, add to or update it, limit the processing to a specified purpose, and object to the processing or its results where it contradicts their fundamental rights and freedoms.

Reply to a request to exercise those rights within six working days of the day it was submitted.

Stop processing a data subject's personal data, including profiling for direct marketing, as soon as they object, unless a listed exception applies, and limit processing on request while a dispute is pending.

Charge nothing for exercising ARCO-POL rights beyond reproduction, certification or delivery costs, and give a reasoned written denial within three business days when you refuse a request.

Honor a person's request to access, rectify, erase, restrict, port, or object to processing of their personal data in Estonia within one month of receipt.

Give a data subject written reasons where you deny an access request, and let them challenge those reasons.

Correct, destroy, or delete personal information on a data subject's request within fourteen days where it is inaccurate, irrelevant, excessive, out of date, incomplete, misleading, or unlawfully obtained, and tell anyone the changed information was disclosed to within seven working days of the correction where it affects a decision about the data subject.

Stop processing personal data for direct marketing, including the profiling related to it, as soon as the data subject objects, and bring the right to object to the data subject's attention explicitly.

Restrict processing on request in the cases article 30 lists, keep the data stored but otherwise unused without the data subject's consent, and tell the data subject before lifting the restriction.

Let the customer challenge the decision you have reached, except in relation to a report as referred to in Article 69 (Article 76(5), point (c)).

Give the consumer the right to express the consumer's own point of view to you (Article 18(8), point (b)).

Give the consumer the right to request a review of the assessment of the creditworthiness and of your decision on the granting of the credit (Article 18(8), point (c)).

Do not make the exercise of choices or rights under Article 4 by the user unduly difficult, including by offering choices to the user in a non-neutral manner or by subverting or impairing the autonomy, decision-making or choices of the user via the structure, design, function or manner of operation of a user digital interface or a part thereof (Article 4(4)).

Where the data holder refuses to share data pursuant to Article 4, notify the competent authority designated under Article 37 (Article 4(2)); where the data holder withholds or suspends the sharing of data identified as trade secrets (Article 4(7)), or refuses a request on the ground of serious economic damage from the disclosure of trade secrets (Article 4(8)), also give the user a duly substantiated decision in writing without undue delay (Article 4(7) and (8)).

Honor a natural person's right to opt out at any time, and without providing any reason, from the processing of personal electronic health data relating to them for secondary use under the Regulation, and keep the exercise of that right reversible (Article 71(1)).

Honor a natural person's right to restrict the access of health professionals and healthcare providers to all or parts of their personal electronic health data as referred to in Article 3: make the natural person aware that restricting access might impact the provision of healthcare to them, and do not make the restriction visible to healthcare providers (Article 8).

Where relying on the contract-necessity or explicit-consent exception, implement suitable safeguards, at minimum the right to obtain human intervention, to express a point of view, and to contest the decision.

Honor a data subject's request to access, rectify, erase, restrict, port, or object to processing of their personal data within one month of receipt, a period that can be extended by two further months where necessary given the complexity and number of requests (Article 12(3)).

On the request of a person performing platform work, or of their representative acting on their behalf in accordance with national law or practice, review a decision referred to in Article 11(1), and respond with a sufficiently precise and adequately substantiated reply in the form of a written document, which may be in electronic form, without undue delay and in any event within two weeks of receipt of the request (Article 11(2)).

Honor a person's request to access, rectify, erase, restrict, port, or object to processing of their personal data in Finland within one month of receipt, unless a Data Protection Act Section 33 or 34 national security, defence, public order, or tax supervisory ground applies.

Give a qualifying Florida consumer a means to confirm whether you process their personal data, access it, correct it, delete data you provided or obtained about them, and receive it in a portable, readily usable digital format.

Offer a Florida consumer an opt-out of targeted advertising, sale of personal data, profiling producing a legal or similarly significant effect, collection or processing of sensitive data including precise geolocation, and collection of personal data through a voice or facial recognition feature.

Give a person in France a path to obtain human intervention, express their view, and contest a decision made solely by automated processing, including profiling, that produces a legal or similarly significant effect on them.

Honor a person's request to access, rectify, erase, restrict, port, or object to processing of their personal data in France within one month of receipt.

Do not subject a person to a decision based solely on automated processing, including profiling, without letting them oppose it.

Where you make such a decision, implement appropriate measures to safeguard the person's rights, freedoms and legitimate interests, including at least their right to obtain human intervention, express their point of view, and contest the decision.

Respond to a data subject's request to access, rectify, erase, restrict, port, or object to the processing of their personal data.

Act on a data-subject request within one month of receiving it, extendable by two months for complex or numerous requests provided you tell the person of the extension and its reasons within the first month; where you decline to act, tell the person why within one month and of their right to complain to the APDPVP or go to court.

Store personal data without processing it further while its accuracy is contested or another ground for restriction applies.

Cease processing personal data for direct marketing immediately upon request, and weigh any other objection made on grounds relating to the data subject's particular circumstances.

An app holding the personal data of a person in Georgia must give that person a way to withdraw consent and to appeal, and must act on a request to exercise their Chapter III rights on demand.

Honor a person's request to access, rectify, erase, restrict, port, or object to processing of their personal data in Germany within one month of receipt.

Where non-automated storage makes erasing a person's data in Germany impossible or disproportionately costly and their interest in erasure is minor, restrict processing of the data instead of erasing it, unless the data were processed unlawfully, under BDSG Section 35(1).

Give a data subject the right to demand that a decision significantly affecting them is not based solely on automated processing of their personal data, and notify them as soon as reasonably practicable when such a decision is taken without a prior notice.

Where a data subject, within twenty-one days after you notify them of a solely automated decision, requires you in writing to reconsider it, reconsider the decision and, within twenty-one days after receiving their notice, tell them in writing what steps you intend to take to comply.

Cease or refrain from processing personal data within twenty one days of a data subject's written notice that the processing causes or is likely to cause them unwarranted damage or distress, or give them your reasons for not complying.

Answer a data subject's request to confirm whether you hold personal data about them, describe it, and correct it, promptly and in any event within forty days of receiving the request.

Honor a person's request to access, rectify, erase, restrict, port, or object to processing of their personal data in Greece within one month of receipt.

Confirm within thirty days of a written access request, accompanied by the prescribed processing fee, whether access will be given, and if so give access within sixty days, subject to an extension of up to thirty more days in narrow circumstances.

State the specific ground for any refusal of access in the written notice, together with the data subject's right to complain to the Commission about the refusal.

A state entity holding records about a person must, on request, disclose what it holds, the purpose for which it is used, and correct, rectify, or update it on request.

Update, rectify or suppress a person's data in your database when they ask, subject to a Habeas Data judicial action.

Let the recipient prohibit that other processing before and during use of the service, and do not link the data to the recipient's identifying data or pass them to a third party without the recipient's consent (Section 13/A, paragraphs 5 and 6).

Give a person in Hungary a path to obtain human intervention, express their view, and contest a decision made solely by automated processing that produces a legal or similarly significant effect on them.

Honor a person's request to access, rectify, erase, restrict, port, or object to processing of their personal data in Hungary within one month of receipt.

For five years after a person in Hungary dies, honor a request to access, rectify, erase, restrict or object to processing of their personal data from someone the deceased authorised, or, failing that, from a close relative, under Information Act (Infotv.) Section 25.

Honor a person's request to access, rectify, erase, restrict, port, or object to processing of their personal data in Iceland within one month of receipt, under Act No. 90/2018.

An app must give a data principal a way to exercise their rights to access, correct, complete, update, or erase their personal data, including a stored voiceprint or faceprint, and to nominate another person to exercise these rights, directly against it, with escalation to the Data Protection Board available only after the app's own grievance process is exhausted.

Give an Indiana consumer a means to confirm whether you process their personal data, access it, correct it, delete it, and receive a portable copy.

Offer an Indiana consumer an opt-out of targeted advertising, the sale of personal data, and profiling that produces a legal or similarly significant effect.

Give an Iowa consumer a means to confirm whether you process their personal data, access it, delete it, and receive a portable copy. ICDPA does not require you to offer a correction mechanism.

Offer an Iowa consumer an opt-out of the sale of personal data. If you sell personal data to third parties or engage in targeted advertising, disclose that clearly and conspicuously together with the manner in which a consumer may opt out of it. ICDPA gives no right to opt out of profiling.

Where an Irish enactment authorises or requires a solely automated decision about a person and the decision does not simply grant what they asked for, let them make representations, request human intervention and appeal the decision, and tell them in writing the steps you took and, on appeal, the outcome, under Data Protection Act 2018 section 57.

Honor a person's request to access, rectify, erase, restrict, port, or object to processing of their personal data in Ireland within one month of receipt.

An app holding the personal data of a person in Israel in a database must give that person a way to access their own data, and must act on a request to rectify or delete it, notifying any prior recipient of the correction or deletion.

Give a person in Italy a path to obtain human intervention, express their view, and contest a decision made solely by automated processing that produces a legal or similarly significant effect on them.

Honor a person's request to access, rectify, erase, restrict, port, or object to processing of their personal data in Italy within one month of receipt.

Honor a request about a deceased person's personal data in Italy from someone with their own interest, an agent protecting the deceased, or someone with a family reason worth protecting, unless the law excludes it or, for information society services offered directly to the person, the deceased expressly forbade it by written declaration, under Codice Article 2-terdecies.

Stop basing a decision that significantly affects a person solely on the automatic processing of their personal data used to evaluate matters such as performance at work, creditworthiness, reliability or conduct, once that person gives you written notice.

Inform a person as soon as is reasonably practicable where you took such a decision without having received that notice, and give them a written statement within 30 days of the steps you will take where they require you to reconsider it.

Give the data subject, on payment of the prescribed fee, their personal data in an intelligible form together with any information you hold as to its source, or, where technically feasible, transmit it to another data controller in a structured, commonly used and machine-readable format.

Identify in writing, within 30 days of the request, the provision you rely on where you refuse to disclose personal data to the data subject.

An app must let an individual in Jordan object to processing or profiling of their data that is unnecessary, excessive, discriminatory, or unlawful for its stated purpose, must let them obtain erasure or concealment of their data and a portable copy transferable to another controller, and must notify them of any data breach affecting the security or integrity of their data.

Give a Kentucky consumer a means to confirm whether you process their personal data, access it, correct it, delete it, and receive a portable copy.

Offer a Kentucky consumer an opt-out of targeted advertising, the sale of personal data, and significant-effect profiling.

Notify a data subject in writing when a decision about them is based solely on automated processing, including profiling, that produces a legal or similarly significant effect, and allow them to request reconsideration or a new decision that is not based solely on automated processing.

Respond to a data subject's request to access, correct or delete their personal data, and to a data portability request within thirty days.

Give a data subject, at no expense and without unreasonable delay, confirmation of whether their personal data is being processed and its source, a copy of it in a commonly used electronic format, correction of data that is inaccurate, out of date, incomplete or misleading, and deletion of data the controller is not entitled to retain.

Answer an access, rectification, erasure, restriction, portability or objection request within one month of receipt, extendable by two further months for complex or numerous requests, and tell the data subject about any extension within the first month.

Restrict processing on request while accuracy is contested, in place of erasure where the data subject prefers restriction, where you no longer need the data but the data subject does for legal claims, or while an objection is being verified, and tell the data subject before lifting the restriction.

Honor a person's request to access, rectify, erase, restrict, port, or object to processing of their personal data in Latvia within one month of receipt.

Let a person object, for legitimate reasons, to the collection and processing of their personal data, including processing for commercial promotion, unless the law obliges you to collect it or they have already agreed to the processing.

Let a person review and object, before the person responsible for processing, to the information and analyses used in the automated processing relating to them that is invoked against them.

Give a data subject written reasons where you deny an access request, and let them challenge those reasons.

Correct, destroy, or delete personal information on a data subject's request within 14 days where it is inaccurate, irrelevant, excessive, out of date, incomplete, misleading, or unlawfully obtained, and tell anyone the changed information was disclosed to within 7 working days of the correction where it affects a decision about the data subject.

Let a person access and update the personal data collected about them, through appropriate technological means.

Do not send a person electronic documents once they have explicitly refused to accept them, and stop processing their personal data once they have explicitly refused it.

Honor a person's request to access, rectify, erase, restrict, port, or object to processing of their personal data in Liechtenstein within one month of receipt.

Where erasing a person's data in Liechtenstein is impossible or disproportionately costly because of how it is processed or stored, and their interest in erasure is low, restrict its processing instead of erasing it, unless the data were processed unlawfully, under DSG Article 35(1).

Honor a person's request to access, rectify, erase, restrict, port, or object to processing of their personal data in Lithuania within one month of receipt.

Give a Louisiana consumer a means to confirm whether you process their personal data, access it, correct it, delete it, and receive a portable copy, once the LDPA takes effect January 1, 2027.

Offer a Louisiana consumer an opt-out of targeted advertising, the sale of personal data, and profiling that produces a legal or similarly significant effect.

Honor a person's request to access, rectify, erase, restrict, port, or object to processing of their personal data in Luxembourg within one month of receipt.

Honour a data subject's request, made on a legitimate ground and free of charge, to object to processing of their data, and stop processing for prospecting purposes as soon as they object to it, without requiring a reason.

Rectify, complete, update, block, or erase inaccurate, incomplete, outdated, or unlawfully held data on request, free of charge, and tell any third party the data were disclosed to of the change.

Honor a data subject's objection, made at any time on legitimate grounds relating to their situation, to the processing of their data, and stop processing that data once the objection is justified.

Give a data subject, on request, the rectification, erasure or blocking of data whose processing does not comply with the Act, in particular because it is incomplete or inaccurate.

A Controller must tell a data subject about the processing of their personal data and answer a request to access it, correct it, erase it, restrict its processing, receive it in a portable form, or object to the processing.

Rectify, complete, update, block, or delete inaccurate, incomplete, ambiguous, outdated, or unlawfully processed personal data on a person's written request, justify within thirty days that you have done so, and notify any third party the data were transmitted to of the correction.

Where a processing concerns State security, national defence, or public security, route an access or rectification request to the Autorité de Protection des Données à Caractère Personnel instead of answering it yourself.

Honor a person's request to access, rectify, erase, restrict, port, or object to processing of their personal data in Malta within one month of receipt.

Give a Maryland consumer a means to confirm whether you process their personal data, access it, correct it, delete it, receive a portable copy, and obtain a list of third-party categories it was disclosed to.

Offer a Maryland consumer an opt-out of targeted advertising, sale of personal data, and profiling in furtherance of solely automated decisions with legal or similarly significant effects.

Do not process a person's personal data once they have validly objected, including where the processing serves commercial prospecting.

Tell the person, at the time of collection, who is responsible for the processing, its purpose, the categories of data, whether a reply is mandatory or optional, and any recipients, and let them access, object to, correct, or delete their data on request.

Respond to a data subject's request for access, rectification, erasure or restriction of processing, or an objection to processing.

Let a data subject or their legal representative exercise the ARCO rights (access, rectification, cancellation, and objection) at any time, without requiring one as a precondition of another, and safeguard their personal data so these rights can be exercised without delay.

Communicate your determination on an ARCO request within twenty days of receiving it, give effect to a favourable determination within fifteen days of communicating it, and put any denial in writing with the reasons.

Honor a data subject's right to object to a fully automated decision that produces undesired legal effects or significantly affects their interests, rights, or freedoms, where that decision evaluates, without human intervention, their professional performance, economic situation, health, sexual preferences, reliability, or behaviour.

Give a Minnesota consumer a means to confirm processing, access, correct, delete, and port their personal data.

Offer a Minnesota consumer the right to opt out of automated profiling in furtherance of decisions with legal or similarly significant effects, question the result, receive an explanation, and have the decision reevaluated if based on inaccurate data.

Answer a request for access, rectification, erasure, restriction or portability, and notify every recipient the data was disclosed to of a rectification, erasure or restriction you carry out.

Stop processing personal data for direct marketing as soon as the data subject objects, including the profiling related to it.

Act on a data subject's rights request concisely, understandably, and in an easily accessible form, in clear and plain language, with particular care where the information is meant for a minor, and answer within one month of receipt, extendable by two months for a complex or repeated request.

Restrict processing on request in the listed cases, keep the data stored but otherwise untouched without the person's consent while the restriction lasts, and tell the person before you lift it.

An app must let a Mongolian data subject know whether their data is collected or processed, correct errors, request deletion, obtain and transfer a copy of their own data to a controller of their choosing, and complain about, add information to, or demand reprocessing of a decision that results from processing their data.

Give a Montana consumer a means to confirm whether you process their personal data, access it, correct it, delete it, and receive a portable copy.

Respond to a consumer rights request without undue delay and within 45 days of receipt, with one 45-day extension available, and decide an appeal of a refusal within 60 days.

Answer a person's written request within 15 days, telling them whether personal data concerning them is processed and, if it is, the controller's identity, the content of the data, the purpose and legal basis, the source and the third party or user, under Article 43.

Expect the rights in Articles 43 and 44 to be restricted only for defence, national or public security, the prevention, detection and prosecution of criminal offences, protection of economic or financial interests, or protection of the person or the rights and freedoms of others, to the extent necessary and in accordance with a special law, under Article 45, and bear the cost of an Article 43 or 44 proceeding yourself, under Article 46.

On a data subject's request, update, rectify, erase, or block personal data whose processing does not comply with the law, free of charge, within ten clear days, and notify anyone the data was disclosed to of the correction.

Honor a data subject's objection to processing on legitimate grounds, and their objection, free of charge, to having their data used for marketing by you or by any later processor.

Where a data subject objects to data concerning them and the objection is accepted, remove, rectify, complete, or alter it.

Give a Nebraska consumer a means to confirm whether you process their personal data, access it, correct it, delete it, and receive a portable copy.

Respond to a consumer rights request without undue delay and within 45 days of receipt, with one 45-day extension available.

Give a person in the Netherlands a path to obtain human intervention, express their view, and contest a decision made solely by automated processing that produces a legal or similarly significant effect on them, subject to UAVG Article 40's exceptions.

Honor a person's request to access, rectify, erase, restrict, port, or object to processing of their personal data in the Netherlands within one month of receipt.

Give a Nevada consumer the right to access their consumer health data, obtain a list of third parties it was disclosed to, stop its collection, sharing, or sale, and delete it.

Respond to a consumer health data rights request within 45 days, with one 45-day extension available, and provide at least two free responses per consumer per year.

Give a New Hampshire consumer a means to confirm whether you process their personal data, access it, correct it, delete it, and receive a portable copy.

Offer a New Hampshire consumer an opt-out of targeted advertising, the sale of personal data, and profiling with legal or similarly significant effects.

Give a New Jersey consumer a means to confirm, access, correct, delete, and port their personal data, and respond within 45 days of receipt (extendable once by 45 days).

Recognize a user-selected universal opt-out mechanism for targeted advertising and sale of personal data. This duty became operative around July 15, 2025, separately from NJDPA's general effective date.

Rectify, modify, suppress, complement, include, update, or cancel a data subject's personal data on request within five business days, notify any assignee of the correction within five business days, block the disputed data while you verify a claimed error, and do this free of charge; you may refuse only where a judicial decision orders you not to modify the data, and you must then tell the data subject of that decision.

Include personal data in a file built for advertising, promotions, offers, or direct sale only with the data subject's consent or from a publicly accessible source, give the data subject free access to it, and let them request removal from it at any time.

Correct, complete, update, lock or erase inaccurate, incomplete, ambiguous or outdated data within one month of a request from the person or a deceased person's heirs.

Do not use a person's data for direct marketing without their prior consent, and stop processing their data for direct marketing, free of charge, as soon as they object, telling them of that right before you first use or disclose their data for that purpose.

Honor a person's request to access, rectify, erase, restrict, port, or object to processing of their personal data in Norway within one month of receipt.

Give an Oklahoma consumer a means to confirm whether you process their personal data, access it, correct it, delete it, and receive a portable copy in a digital format.

Offer an Oklahoma consumer an opt-out of targeted advertising, the sale of personal data, and profiling that produces a legal or similarly significant effect.

An app must let an individual in Oman revoke their consent, request amendment or blocking of their data, obtain a copy of it, transfer it to another controller, request its erasure (unless national archiving requires otherwise), and must notify them of any breach or infringement of their personal data and the actions taken in response; these rights apply to a voiceprint, faceprint, or other biometric identifier like any other personal data.

Respond as soon as possible and no later than 30 days after receiving the request. You may extend by not more than 30 days if meeting the limit would unreasonably interfere with your operations or the consultations needed make it impractical, and you must give the individual written notice of the extension and the reason.

If you refuse a request in whole or in part, give written notice. Unless the refusal rests on legal proceedings, an inspection or investigation, or a risk of harm, the notice must give the reason and state that the individual may complain to the Commissioner.

Give an Oregon consumer a means to confirm whether you process their personal data, disclose the categories processed, provide a portable copy, correct it, and delete it.

Offer an Oregon consumer an opt-out of targeted advertising, sale, and profiling for decisions with legal or similarly significant effects.

Correct, cancel, or stop processing a data subject's personal data on request when it is incorrect, irrelevant, incomplete, outdated, inaccurate or false, and let them revoke consent.

Answer an access request within ten business days free of charge, and complete a correction, blocking, or deletion within five business days of the request.

Let a data subject ask for review of a decision based on automated processing of their personal data that adversely affects their interests or produces legal effects, express their point of view and contest it, and on request give them clear, complete information about the criteria and procedures the decision used.

Honor a data subject's rights of access, rectification, deletion, objection and portability, free of charge.

Answer a request under articles 28 to 32 on the terms article 26 sets for the exercise of those rights.

Correct, update, include, or delete a person's personal data on request when it is inaccurate, incomplete, or has outlived the purpose or period for which it was collected, tell anyone you previously transferred it to about the change, and block the data from third-party access while the request is pending.

Stop supplying a person's personal data to others on their request to prevent supply, especially where the supply would affect a fundamental right.

An app holding the personal information of an individual in the Philippines must give that individual a way to be informed, object, access, correct, and erase their data, and must provide a copy of their data in a structured, commonly used, machine-readable format on request.

Give a person in Poland a path to obtain human intervention, express their view, and contest a decision made solely by automated processing that produces a legal or similarly significant effect on them.

Honor a person's request to access, rectify, erase, restrict, port, or object to processing of their personal data in Portugal within one month of receipt.

On the person's request, disclose the personal information used to reach the decision, the reasons and the principal factors and parameters that led to it, and their right to have that personal information corrected.

Give the person an opportunity to submit observations to a staff member who is in a position to review the automated decision.

Let a data subject object to processing of their personal data on legitimate grounds, and tell them, before their data is first communicated to or used by a third party for prospecting, of their free right to object to it.

Answer a request for rectification, completion, updating, blocking or erasure of inaccurate, incomplete, ambiguous, outdated or unlawfully processed personal data within one month of registering it, free of charge.

Give a Rhode Island customer a means to confirm whether you process their personal data, access it, correct it, delete it, and receive a portable copy.

Offer a Rhode Island customer an opt-out of targeted advertising, the sale of personal data, and significant-effect profiling.

Give a person in Romania a path to obtain human intervention, express their view, and contest a decision made solely by automated processing that produces a legal or similarly significant effect on them.

Honor a person's request to access, rectify, erase, restrict, port, or object to processing of their personal data in Romania within one month of receipt.

Explain to the data subject how such a decision is made and its possible legal consequences, let them object and explain how they can protect their rights, and consider an objection within thirty days and tell them the result.

Honor a Russian data subject's request for confirmation of processing, correction, deletion, or consent withdrawal, under Federal Law No. 152-FZ.

Within thirty days of a request to object, port, erase or rectify personal data, tell the data subject in writing or electronically whether you complied and, if not, why, and expect the supervisory authority to answer an appeal against your response within sixty days.

Stop processing a data subject's personal data on their objection, including for direct marketing or related profiling, unless you can demonstrate compelling legitimate grounds that override their interests, rights and freedoms.

Give written notice of your access decision within thirty days of a data subject's request, or notify an extension of up to thirty days in the circumstances the Act lists, and tell the data subject of their right to complain to the Information Commissioner.

Refuse an access request only where you lack information to identify the requester or locate the data, compliance would breach an exemption or a duty of confidentiality, another identifiable individual has not consented to disclosure, or the Information Commissioner has not approved the refusal in writing.

Once Part 5 is in force, correct inaccurate personal data on request and stop processing a person's personal data for direct marketing on their objection.

On a registered person's request, correct or, where correction is not feasible, delete personal data that is inaccurate, out of date, incomplete, or misleading, or that the National Digital Identification System or relying party is not entitled to retain.

Implement measures that let a registered person effectively exercise these access, correction, and information rights, and provide a way to lodge a grievance over improper use of their data.

Answer a request for access, rectification, erasure, restriction or portability, and notify every recipient the data was disclosed to of a rectification, erasure or restriction you carry out.

Stop processing personal data for direct marketing as soon as the data subject objects, including the profiling related to it.

Answer a data holder's request, free of charge, at reasonable intervals and without undue delay, with confirmation of whether you are processing their data, the purposes, the categories of data and recipients, the data itself in an intelligible form, its origin, and the reasoning behind any automated processing decision about them, and correct, erase or block data that does not comply with this Law.

Let a data holder object, for weighed and legitimate reasons relating to their particular situation, to your continued processing of their data, and stop processing their data for direct marketing or another commercial solicitation, free of charge, as soon as they object or before you first communicate their data to a third party for that purpose.

Tell the person, at the time of collection, who is responsible for the processing, its purpose, the categories of data, whether a reply is mandatory or optional, and any recipients, and let them access, object to, correct, or delete their data on request.

Let a person object, free of charge and for legitimate reasons, to processing of their data, and correct, complete, update, block, or delete it within one month of a written request where it is inaccurate, incomplete, ambiguous, outdated, or unlawfully processed, notifying any third party the data was disclosed to.

Restrict processing on request while accuracy is disputed, the processing is unlawful but the person opposes erasure, you no longer need the data but the person needs it for a legal claim, or an objection is pending.

Stop processing a person's data for direct marketing, including related profiling, the moment they object, and tell them about this right clearly and separately no later than your first contact with them.

Give a data subject access to, and the ability to correct or delete, their personal data on request.

An app holding the personal data of an individual in Singapore must give that individual a way to access and correct their personal data on request.

Give a person in Slovakia a path to obtain human intervention, express their view, and contest a decision made solely by automated processing that produces a legal or similarly significant effect on them.

Honor a person's request to access, rectify, erase, restrict, port, or object to processing of their personal data in Slovakia within one month of receipt.

Give a person in Slovenia a path to obtain human intervention, express their view, and contest a decision made solely by automated processing that produces a legal or similarly significant effect on them.

Honor a person's request to access, rectify, erase, restrict, port, or object to processing of their personal data in Slovenia within one month of receipt.

When you process personal data in Slovenia for scientific, historical or statistical research, honor access and objection requests, and rectification, erasure, restriction or portability requests where exercising them would not jeopardise the research, under ZVOP-2 Article 69(8).

On request, confirm whether you process a person's personal data and where it came from, give them a copy in a commonly used electronic format, and correct or delete data that is inaccurate, out of date, incomplete or misleading, at no expense and without unreasonable delay.

Stop processing personal data a data subject validly objects to, unless a public interest or other legitimate ground outweighs the unwarranted damage or distress.

Correct or delete personal information a data subject shows is inaccurate, irrelevant, out of date, incomplete, misleading or unlawfully obtained, and tell the data subject what action you took.

Do not process personal information for direct marketing by electronic communication unless the data subject has consented, or is an existing customer given a free and simple chance to opt out at collection and on every marketing contact afterward.

Apply default privacy settings and limit profiling, targeted advertising, and precise-geolocation collection for a known minor user, and provide parental controls.

An app must let a Korean data subject confirm whether their personal information is being processed, and give them a way to access, correct, or delete it, or to demand that its processing be suspended.

An app that makes a decision about a Korean data subject using a fully automated system, including one applying artificial intelligence, that significantly affects the subject's rights or obligations, must let the subject object to or request an explanation of the decision, must not apply the decision over an objection absent a compelling reason or must reprocess it with human involvement, and must disclose the criteria and procedures it uses for automated decisions.

Give a person in Spain a path to obtain human intervention, express their view, and contest a decision made solely by automated processing that produces a legal or similarly significant effect on them.

Give a person in Spain a path to exercise access, rectification, erasure, restriction, portability, and objection rights under LOPDGDD Articles 11-18.

An app must give a data subject in Sri Lanka a way to access, withdraw consent for, rectify, or erase their personal data, including a stored voiceprint or faceprint, and must respond to a written request within one month, extendable by up to two further months with notice; a refusal is appealable to the Data Protection Authority.

Let a data subject obtain confirmation that you are processing their personal data, and on request give them the reasons underlying a decision produced by processing their data.

Let a data subject object at any time to processing on grounds relating to their situation, and stop processing their personal data for direct marketing and any related profiling outright as soon as they object to it.

Give a person in Sweden a path to obtain human intervention, express their view, and contest a decision made solely by automated processing that produces a legal or similarly significant effect on them.

Honor a person's request to access, rectify, erase, restrict, port, or object to processing of their personal data in Sweden within one month of receipt.

Honor a Swiss data subject's request for access, rectification, deletion or destruction, or objection to processing, and provide portability for data they gave you and that you process by automated means, under FADP Articles 25 to 32.

Tell a data subject, on request, the nature, purpose and method of processing their personal data and the retention period or how it is set, and let them access their own data, withdraw a prior consent without retroactive effect, correct, delete, add to or update it, confine your processing to a defined purpose, and object to processing that violates their constitutional rights.

Answer any other request from a data subject to exercise a right under this law within seven working days of its submission.

When a data subject requires it, ensure that a decision significantly affecting them is not based solely on automatic processing; where such a decision is made, notify them as soon as practicable and reconsider it if they ask, unless the decision is necessary for a contract with them, authorised by written law, or based on their explicit consent.

On a data subject's request, tell them whether you are processing their personal data, and describe the data, the purposes of the processing and the recipients it is or may be disclosed to.

Suspend or do not begin processing a data subject's personal data when they require it because the processing is likely to cause substantial damage to them or to another person, unless an exception in the Act applies.

Give a Tennessee consumer a means to confirm, access, correct, delete, and port their personal information, and offer an opt-out of targeted advertising, sale, and certain profiling.

Respond to a consumer rights request within 45 days of receipt (extendable once by 45 days) and to an appeal of a denial within 60 days of receipt.

Give a Texas consumer a means to confirm whether you process their personal data, access it, correct it, delete it, and receive a portable copy.

Offer a Texas consumer an opt-out of targeted advertising, the sale of personal data, and profiling that produces a legal or similarly significant effect.

Let a data subject object, on legitimate grounds, to the processing of their personal data, and tell them before their data is first disclosed to or used by a third party for prospecting, offering a free right to object to it, unless the processing meets a legal obligation.

Correct, complete, update, lock or delete personal data on a data subject's written request within one month and at no cost, when it is inaccurate, incomplete, ambiguous, outdated or unlawfully held, and notify any third party the data was disclosed to.

On request, confirm whether you process a data subject's personal information and where it came from, give them a copy in a commonly used electronic format, and correct or delete information that is inaccurate, out of date, incomplete or misleading, without constraint or unreasonable delay and at no expense.

Act on a written request to stop processing personal information for direct marketing as soon as reasonably practicable, and in any event within 30 days of receiving it.

Once Part IV is in force, respond to an individual's access request against your organisation the same way a public body must under Part III, and follow whatever access, correction, and complaint procedure your mandatory code of conduct states.

Let the person consult, correct, complete, rectify, update, clarify or erase their own personal data, and give them a copy in clear language and, where it was processed automatically, an intelligible form, free of charge, within one month of their request.

Offer an electronic channel for a rectification, modification, correction or erasure request where you process personal data by automated means.

An app must give a person in Turkey a way to learn whether their personal data is processed, access information about that processing, and request correction or erasure.

An app must let a person in Turkey object to a result against them that arises from analysis of their data solely through automated systems.

Correct or delete personal data on a data subject's request where it is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or obtained unlawfully, tell the data subject the outcome, and notify every person the data was previously disclosed to of a correction made.

Stop processing personal data within fourteen days of a data subject's written notice that the processing causes or is likely to cause them unwarranted substantial damage or distress, unless the processing falls under section 7(2), and comply within seven days if the Authority orders you to.

Give a data subject in Ukraine the right to erasure of their personal data.

Give a data subject in Ukraine the right to restriction of processing of their personal data.

Give parents a way to review and delete a child's collected personal information.

Correct, update, include, or delete a data subject's personal data within five business days of their request when it is erroneous, false, or missing, or explain why it does not, and notify any recipient of the data of the correction within five business days.

On request, remove or block a data subject's data from a marketing, canvassing, or profiling database at any time, and give the data subject access to the data you hold in such a database free of charge.

As a motor vehicle manufacturer selling or leasing vehicles in Utah, once in effect, provide in-vehicle privacy controls letting a consumer view what personal data categories the vehicle collects and shares, opt out of sale or targeted-advertising processing, and delete readily accessible data stored locally on the vehicle.

On a data subject's request, correct or erase inaccurate, unlawfully processed or no longer necessary personal data, and restrict processing in the circumstances section 10 lists.

Let a data subject object to the processing of their personal data.

Update, correct, or delete a person's data on their request to the competent court if it is erroneous or illegitimately affects their rights.

Give a Vermont consumer access, correction, deletion, portability, opt-out of targeted advertising and sale, a profiling explanation and reevaluation right for housing decisions, and a list of third parties their data was sold to.

Respond to a consumer rights request without undue delay and not later than 45 days after receipt, with one 45-day extension available.

Give a Virginia consumer a means to confirm whether you process their personal data, access it, correct it, delete it, and receive a portable copy.

Offer a Virginia consumer an opt-out of targeted advertising, the sale of personal data, and profiling that produces a legal or similarly significant effect.

Let a data subject access, correct, delete, or restrict the personal data held about them.

Stop processing personal data for direct marketing as soon as the data subject objects, and bring the rights of objection to their attention clearly and separately at your first communication with them.

Give a data subject notice of who is responsible for processing and why, and let them access, object to, correct, or have deleted false or misleading personal data about them.

Give that customer a clear and distinct, simple and free chance to refuse the use of the contact details, in every single message where the customer did not refuse that use originally.

Do not send electronic mail that spreads a commercial communication if it is not clearly marked as a commercial communication, hides the identity of the sender on whose behalf it is sent, or is sent without a valid address to which the recipient can directly and effectively send a request to stop further commercial messages.

Include in every item of commercial electronic mail sent to a Delaware receiving address information telling the recipient how to unsubscribe or stop receiving further commercial electronic mail from you, and stop sending it once a recipient asks you to.

You need no prior consent to market your own similar products by electronic mail to a customer whose electronic address you received in connection with a sale, but you must give the customer a clear and unambiguous, easy and free opportunity to object when you receive the address and in every later contact (section 10, paragraph 2).

In every direct-marketing electronic mail, make the marketing clearly identifiable as such, make the conditions of promotional measures easy to reach and clearly presented, show on whose behalf it is sent without concealing it, do not urge the recipient to visit websites that fail those requirements, and give an address the recipient can use to stop such contact (section 10, paragraph 3).

When you use a legal person's electronic contact details for direct marketing, give a clear and understandable chance to refuse the use free of charge and in a simple way each time, and let the person exercise the right to refuse through the electronic communications network (section 103^1(2)).

You need no prior consent to market your own similar products or services to a buyer whose electronic contact details you obtained in connection with a sale, but you must give the buyer a clear and understandable chance to refuse free of charge and in a simple way when you first collect the details and every time you use them, and let the buyer exercise the right to refuse through the electronic communications network (section 103^1(3)).

When you undertake unsolicited commercial communications by electronic mail, consult regularly and respect the opt-out registers in which natural persons not wishing to receive such commercial communications can register themselves (Article 7(2)).

Where you collected a customer's electronic contact details in the course of selling them a product or service, in accordance with Directive 95/46/EC, you may market your own similar products or services to that customer without fresh consent, provided you offered a free, easy opt-out at the time of collection and offer it again, free of charge, in every message, unless the customer already refused.

Never send a direct-marketing electronic mail (including a text message) that disguises or conceals the sender's identity, that itself contravenes Directive 2000/31/EC Article 6's disclosure rules, or that has no valid address the recipient can use to ask that the messages stop, and never encourage the recipient to visit a website that itself breaches those rules.

It reaches you if you are a trader, meaning a natural or legal person acting for purposes relating to your trade, business, craft or profession, or anyone acting in the name of or on behalf of a trader (Article 2, point (b)), in a commercial practice directed at consumers (Article 3(1)): do not make persistent and unwanted solicitations by telephone, fax, e-mail or other remote media, except in circumstances and to the extent justified under national law to enforce a contractual obligation; the practice is in all circumstances regarded as unfair (Annex I, point 26, and Article 5(5)).

Market to a natural person by other means only if the person has not expressly prohibited it, and make it possible for a natural person to prohibit such marketing easily and free of charge (section 200, paragraph 2).

You may use a customer's contact details for e-mail, text, voice, sound or image messages, obtained in the sale of a product or service, to market your own products and services of the same product group or otherwise corresponding, without prior consent, only if the customer can prohibit that use easily and without separate charge when the details are collected and with every message, and you clearly tell the customer of that possibility (section 200).

You may email direct marketing without fresh consent only where the recipient's details were collected from them, in compliance with the Loi Informatique et Libertés, in connection with a sale or a provision of services, the marketing concerns similar products or services supplied by the same person, and the recipient was offered, expressly and unambiguously, a simple way to object free of charge, apart from the cost of sending the refusal, when the details were collected and in each marketing email where they had not refused at the outset.

In every such message, give valid contact details to which the recipient can send a request that the communications stop, free of charge apart from the cost of sending it.

You may market your own similar goods or services to an existing customer by electronic mail without fresh consent only if you obtained their electronic address in connection with a sale, they have not objected to that use, and you clearly told them, both when collecting the address and at every use, that they may object at any time at no cost beyond the basic transmission tariff.

Every advertising message must carry a valid address the recipient can use to ask that such messages stop, usable at no cost beyond the basic transmission tariff.

If you use electronic mail contact details lawfully obtained in a sale of products or services or another transaction to promote your own similar products or services without prior consent, give the recipient a clear and distinct way to object easily and free of charge when you collect the details and in every message.

Do not send electronic mail for direct commercial promotion that omits the clearly stated identity of the sender or of the person for whose benefit it is sent, that has no valid address at which the recipient can ask for the communication to stop, or that encourages recipients to visit websites that breach the Article.

Let the recipient withdraw the consent at any time, free of charge and without restriction or reasons, and stop sending advertising in that way once it is withdrawn. Provide both postal and electronic mail routes for withdrawing consent or prohibiting the sending of advertising (section 6, paragraphs 3 and 6).

In advertising communicated under paragraph 1 or 4, clearly and conspicuously tell the recipient the address and other contact where they can withdraw consent or prohibit sending (section 6, paragraph 7).

Establish a toll-free number or a valid sender-operated return email address the recipient of an unsolicited commercial email can use to ask you to stop, and do not sell or transfer the address of anyone who has made that request.

Provide, in the service, an easily accessible mechanism that lets the recipient stop receiving advertising from you by that electronic communication, and comply with any applicable regulations made under section 144 of the Act.

Where the recipient is not a natural person (a company or other organisation), you may send automated-calling, fax, or email marketing unless that recipient has told you it does not consent; for automated-calling and fax marketing, you also may not send it if the recipient's number is recorded on the National Directory Database's opt-out list.

You do not need fresh consent to market your own similar products or services to an existing customer if you gave them a free, easy opt-out when you collected their details and offer one again in every later message, and the original sale, or your last email marketing use of those details, was within the last 12 months.

If you use for direct sale of your own products or services the email contact details that a data subject gave you in the context of a sale of a product or service, you may do so without consent only for services similar to those sold and if the data subject, adequately informed, does not refuse that use, initially or on later communications. Tell the data subject at collection, and in every communication sent on that basis, that they can object at any time, easily and free of charge.

Do not send such communications, or any communication for promotional purposes, while disguising or concealing the sender's identity, in breach of Article 8 of Legislative Decree 70/2003, without giving a suitable contact where the data subject can exercise the rights in Articles 15 to 22 of the GDPR, or by urging recipients to visit websites that breach that Article 8.

Identify an unsolicited commercial email clearly and unequivocally as such from the moment the recipient receives it, and state that the recipient can object to receiving such communications in future.

You need no consent to use e-mail addresses you obtained from recipients in your commercial transactions for further commercial notices, but only about your similar goods or services, only if the recipient did not object at the outset, and only if every later notice gives a clear free-of-charge chance to refuse further use of the address (article 9, paragraph 2).

Do not send a commercial notice by electronic mail or other communication through publicly available electronic communications services with an invalid e-mail address, or an invalid telephone or fax number to which the recipient could send a request to stop the communication, or while disregarding the recipient's refusal of further notices (article 9, paragraph 4).

Obtain the prior consent of the subscriber or registered user of public electronic communications services before you use electronic communications services, including electronic mail, for direct marketing; where the subscriber or registered user is a legal person, consent is not needed but give it a clear, free and easily exercised possibility to refuse further use for direct marketing.

If you use the electronic mail contact details of a customer who is a natural person, obtained in providing services or selling goods, to market your own similar goods or services without prior consent, give the customer a clear, free and easily exercised possibility to refuse when the details are collected and, unless the customer objected at first, in every message you send.

If you obtained your customers' electronic contact details in a sale of a product or service and use them to market your own similar products or services without prior consent, clearly and expressly give the customers the right to object, free of charge and in a simple manner, when you collect the details and in each message, unless they refused such use from the outset.

Do not send electronic messages for direct marketing that disguise, conceal or misrepresent the identity of the sender on whose behalf the communication is made, or that give no valid address to which the recipient can send a request to stop such communications.

You may use electronic mail contact details obtained from customers in relation to the sale of a product or service to market your own similar products or services without fresh consent only if customers are given the opportunity to object, free of charge and in an easy and simple manner, when the details are collected and on the occasion of each message where the customer has not initially refused (regulation 9(2)).

If you use any other means of communication for direct marketing, make sure, at no charge to the subscriber or user, that no such communication is sent once the subscriber or user requests that it cease (regulation 9(3)).

Once a recipient notifies you that they do not want to receive further unsolicited commercial e-mail, do not send that recipient further unsolicited commercial e-mail, directly or through a third party, and keep policies and records, updated at least every 14 business days, so that the recipient receives none from the date of the notice.

A commercial e-mail you intentionally send unsolicited through an e-mail service provider you knew or should have known is located in Michigan, or to an address you knew or should have known is held by a Michigan resident, must carry "ADV:" as the first four characters of the subject line, your legal name, correct street address, valid domain name and valid return e-mail address, and a toll-free number, return e-mail address or other easy electronic method the recipient can use to opt out, with a notice of it in print as large as most of the message; this labeling, identification and opt-out duty is not framed as a rule against falsity or deception.

You may use electronic contact details obtained from your customers in the context of the sale of a product or service for unsolicited commercial communication about your own similar products or services without fresh consent only if you can show that origin and clearly and explicitly offered the customer, free of charge and in an easy manner, the chance to object to that use when the details were collected and, if they did not object then, in every message you send.

An idealistic or charitable organization may use contact details obtained in connection with a donation to it for unsolicited communication for its own idealistic or charitable purposes without fresh consent only if it can show that origin and offered the same chance to object at collection and in every message.

Do not disguise the source of an advertisement, use false or misleading subject-line information, give a false return address or a false address for declining mail, ignore a recipient's request to stop, or obtain a recipient's address by a method they did not authorize.

The federal CAN-SPAM Act's preemption clause supersedes a state statute that expressly regulates commercial email except to the extent it prohibits falsity or deception, and the following duty is not framed as such a prohibition: when sending an unsolicited commercial electronic mail message to a recipient with whom you have no consent and no established business relationship, mark the first characters of its subject line "ADV:", or "ADV-ADULT:" for sexually explicit content, and give the recipient a free, working way to opt out of future messages; this does not reach a message you send only to your own members, employees, or contractors.

Once a person who has received unsolicited and unwanted advertising material for the sale of real estate, goods or services on a facsimile machine gives you written notice to discontinue, do not use a facsimile machine to send that person unsolicited advertising material for the sale of real estate, goods or services for one calendar year from the date of the notice.

Operate a valid return email address or toll-free telephone number that the recipient of an unsolicited commercial email or fax can use to tell you to stop sending them.

Obtain the prior express consent of the subscriber who is a natural person, or of the user, before you send unsolicited communications for direct marketing, in particular by automated calling and communication systems that do not depend on human intervention, by fax machine, or by electronic mail including SMS, EMS and MMS; for a subscriber that is a legal person, stop once the subscriber refuses future communications or registers on the list provided for in Article 13-B.

If you obtained your customers' electronic contact details in a sale of a product or service and use them to market your own similar products or services without prior consent, clearly and explicitly give the customers a free and easy chance to refuse, when you collect the details and on the occasion of each message where the customer did not refuse initially.

You need no prior consent to use a client's electronic mail address, which you obtained directly when selling the client a product or service, for commercial communications about your own similar products or services, but you must clearly and expressly offer a simple and free way to object when you obtain the address and with each message, where the client did not object initially (article 12, paragraph 2).

Do not send commercial communications by electronic mail that hide the real identity of the person on whose behalf they are made contrary to article 5 of Law 365/2002, that give no valid address to which the recipient can send a request to stop such communications, or that encourage recipients to visit internet pages contrary to article 5 of Law 365/2002 (article 12, paragraph 3).

Let the subscriber or user withdraw consent or object to calls at any time, confirm the withdrawal or objection provably within 30 days, and keep the confirmation on a durable medium for at least four years (section 116, paragraph 6).

You need no prior consent for e-mail, SMS or MMS marketing of your own similar goods and services where you obtained the contact details in connection with a sale, or for marketing addressed to the published contact details of a subscriber or user who is a sole trader or a legal person. Give the recipient an easy and free possibility to refuse that use of contact details when the details are collected and in every message, and stop using details obtained in a sale one year after the contractual relationship ends (section 116, paragraphs 15 and 16).

You need no prior consent to use a buyer's e-mail address, obtained from the buyer of your products or services, for direct marketing of your own similar products or services, but you must clearly and expressly offer a free and simple way to refuse when you obtain the address and with every message, where the buyer did not refuse at the start (article 226, paragraph 2).

Do not send direct-marketing e-mail, contrary to the law on electronic commerce, that hides or disguises the identity of the sender on whose behalf it is sent or has no valid address to which the recipient can send a request to stop such messages, and do not send direct-marketing e-mail that invites recipients to visit websites contrary to that law (article 226, paragraph 5).

In every case, offer the recipient a simple and free way to object to the processing of their data for promotional purposes, both when you collect the data and in each commercial communication you send (Article 21(2)).

For communications sent by e-mail, include a valid e-mail or other electronic address where the right to object can be exercised; do not send communications that omit it (Article 21(2)).

Before you carry out direct marketing communications, consult the advertising exclusion systems that may affect your action and exclude from the processing the data of the people who have expressed their opposition or refusal; consulting the systems on the list published by the competent supervisory authority is enough (Article 23(4)).

You need no consent for marketing by electronic mail to an address you obtained from the person in connection with a sale of a product to them only if they have not objected to that use, the marketing concerns your own similar products, and you clearly and distinctly give them a free and easy chance to object when you collect the address and in every later marketing message (section 19, second paragraph).

Put in every marketing message sent by electronic mail a valid address to which the recipient can send a request that the marketing stop, also when the recipient is a legal person (section 20).

For an unsolicited commercial electronic mail message, put "ADV:" first in the subject line, or "ADV: ADULT ADVERTISEMENT" if it contains obscene material or material depicting sexual conduct, and provide a functioning return email address to which the recipient can send a removal request at no cost; remove the address within three days after receiving the request.

Do not sell or otherwise provide to anyone the email address of a person who has asked to be removed, except as other law requires.

You do not need consent if you obtained the recipient's contact details in the course of a sale or sale negotiation with them, you market only your own similar products or services, and you gave the recipient a simple, free means of opting out at the time the details were collected and with every later message.

From 5 February 2026, a charity does not need consent to email or text someone to further its own charitable purposes if it obtained their details because they expressed an interest in, or offered or gave support to, those purposes, and gave them a simple, free means of refusing at collection and with every later message.

Every commercial email must carry accurate header and routing information, a subject line that is not deceptive about the message's contents, clear and conspicuous identification that the message is an advertisement unless the recipient gave prior affirmative consent, a functioning return address or other opt-out mechanism, and a valid physical postal address of the sender.

Honor an opt-out request within 10 business days, and do not sell, lease, or transfer the recipient's address after receiving the request except to a person retained to help you comply with it.

Stop sending further messages to that address within 10 days of a request to stop, and provide a cost-free, clearly identified opt-out mechanism in every message.

Do not make unsolicited calls with human intervention for those purposes to a subscriber who has declared to the provider of the publicly available service that the subscriber does not wish to receive such calls in general.

If you provide a publicly available electronic communications service, enter those subscriber declarations free of charge in a special directory of subscribers that is available to any interested person.

If the called person asks to be taken off your contact list, do not call that person again and remove their name and number from your contact records; complying with the Federal Trade Commission's Telemarketing Sales Rule do-not-call provision satisfies this duty.

Before making a live telephone call for direct marketing, check that the called line has not told you not to call and is not recorded on the National Directory Database's opt-out list; if neither applies and the number is not a mobile, you do not need the recipient's prior consent for that call alone.

Let a subscriber or user register an objection, or a request to be added to the National Directory Database, free of charge.

Consult the public register of oppositions monthly, and in any case before each promotional campaign, and update your lists. A consultation is effective for fifteen days for telephone and thirty days for paper mail.

Do not process a registered number or postal address for those purposes by telephone or paper mail. A registration or renewal made on the subscriber's explicit request revokes the consents previously given for processing the number by telephone or paper mail. After a revocation of the opposition you may process a national number if you collected specific consent after the latest registration or renewal, in line with the GDPR.

If you sell or use an automatic telephone dialing system in Massachusetts, defined as terminal equipment that stores or produces telephone numbers using a random or sequential number generator and can deliver a prerecorded message, design and operate it to prevent dialing any number a customer has asked their own common carrier not to call, and to automatically release the called party's line within five seconds after they hang up.

If you are a common carrier, let a customer notify you, at no charge, that they do not wish to receive automatic-dialing-system calls, and offer that opportunity when their telephone is installed and at least once a year afterward.

Do not place an unsolicited telephonic sales call to a consumer whose name and telephone number appear on the office's current no sales solicitation calls listing, call between 8 p.m. and 8 a.m. local time at the consumer's location, send the solicitation by fax, or use a recorded message device.

Do not make a telephone solicitation to a residential telephone subscriber whose name and number are on the federal do-not-call list, or to a consumer who has asked not to receive calls from or for your organization, and use the do-not-call list for no other purpose.

Do not telemarket to a Montana residence before 8 a.m. or after 9 p.m. local time, call someone who has said they do not wish to receive solicitation calls from you, use threatening, intimidating, profane or obscene language, engage anyone in conduct a reasonable person would find annoying, abusive or harassing, or intentionally block caller identification (an accurate substitute name and a working number are allowed).

Do not make a telephone solicitation (a voice call from a live operator or an automatic dialing-announcing device encouraging a purchase, rental or investment) to a Montana residential subscriber listed on the state no-call database, unless the subscriber invited it, has had business contact with you in the past 180 days or has a current business or personal relationship with you, or another listed exception applies (a 501(c)(1) to (c)(6) organization's fundraising call by a bona fide member, a federally regulated caller with its own no-call list, a natural person's referral or home-based call, or a licensed professional setting an appointment).

When you send such communication with consent, give the natural person, with every message, a clear and explicit opportunity to object, free of charge and in an easy manner, to the use of their contact details.

Do not make an unsolicited call for the sale of goods or services to a number on the currently effective registry list, unless you have a preexisting business relationship with that person (a purchase or other financial transaction directly with you within the preceding 18 months), keep an internal do-not-call registry of people who asked you not to call, and send each such customer an annual written notice explaining how to join it.

Do not make a telemarketing sales call, one made to induce payment or an extension of credit for goods or services or to gather information for such a solicitation, to a New Hampshire customer who has registered with the national do-not-call registry, and obtain the registry's quarterly listings.

Do not make or cause to be made an unsolicited telemarketing sales call or message, including a cellular telephone text message, to a consumer more than thirty days after that consumer's telephone number first appears on the Attorney General's no-telemarketing-sales-call registry, unless you have an established business relationship with the consumer or the number has since been removed from the registry.

Before using an automatic dialing and announcing device to call a subscriber, design or operate it to disconnect within 10 seconds after the subscriber ends the call, and to offer the subscriber a one-touch or one-digit method within the first 10 seconds to opt out of future calls from you, unless you are a collection agency, debt buyer, debt collector, a public safety or law enforcement representative, or you have an established business relationship with the subscriber.

Do not use such a device to dial a fire, law enforcement or other emergency agency, a hospital, health care facility, physician's office, poison control center, or suicide-prevention or domestic-violence counseling service; do not dial a subscriber who used the device's opt-out against you unless you are a collection agency, debt buyer or debt collector, a public safety or law enforcement representative, or have an established business relationship; and, when dialing randomly or sequentially, do not dial a subscriber on an official government do-not-call list unless you have an established business relationship, are a debt buyer or subject to the Fair Debt Collection Practices Act, are a public safety or law enforcement representative, or are a school district or school calling its employees, students or their families.

Before placing a telephone solicitation call, screen it against the current list published by the administrator of Oregon's telephone solicitation program, which may include the part of the federal do-not-call registry relating to Oregon, and do not call a number on that list.

Do not knowingly, or while consciously avoiding knowledge, provide substantial assistance or support, including carrying or facilitating calls, for another person's violation of this registry ban, unless you are a common carrier or a network operator on whose network the call merely terminates.

Once a party you call or text as part of a telephone solicitation states a desire not to be called or texted again, do not make a subsequent telephone solicitation of that party at that number.

Do not make a telephone solicitation, including a text message or ringless voicemail, on a Sunday, on a legal holiday, or before 9 a.m. or after 7 p.m., or to a subscriber who has told you they do not want solicitations from you or your seller (for a text message, a reply such as stop, quit, end, revoke, opt out, cancel or unsubscribe), or to a number on the do-not-call list once 30 days have passed since the quarterly list that first contains it; obtain the list quarterly and use it only to remove numbers.

If you use robocalls, state at the start of each call how to opt out, offer an automated voice or key-press opt-out within two seconds of identifying the caller and the seller and throughout the call, remove an opting-out number immediately, never require written consent to opt out, and leave a toll-free number reaching that opt-out in any voicemail message.

Do not make any call for direct marketing to a telephone number that the subscriber or user entered in the Authority's list, or to a person who objected to such calls to the person for whom the marketing is done, unless the subscriber or user gave that person consent after the last update of the entry (section 116, paragraph 8).

Check in the list on the Authority's website every telephone number or group of numbers you intend to call for direct marketing, and pay the fee the Authority sets for the check (section 116, paragraph 10).

At each marketing or research call, respect the prohibition on using the subscriber's personal data for commercial or research calls that is marked in the latest published electronic directory (article 217, paragraph 5, applied through article 226, paragraph 3).

Do not use another method of individual communication at a distance, which includes a call placed by a person, to market to a natural person who has clearly objected to that method being used (section 21).

Do not make a telemarketing call (an unsolicited call, text message included, to solicit a sale of a consumer good or service, credit for one, or information for either) to a number more than 60 days after it appears on the Texas no-call list.

When you make a facsimile solicitation from Texas, include in at least 12-point type your complete name and street address and a toll-free or local number answered by a person on weekdays from 9 a.m. to 5 p.m. or that automatically deletes the recipient's number; on a stop request, send a written acknowledgment within 24 hours and make no further transmission to that number.

Do not transmit, or instigate the transmission of, an unsolicited direct-marketing fax to an individual subscriber unless they have consented, to a corporate subscriber who has told you not to, or to any subscriber whose number is listed on the fax-marketing register the Information Commission keeps, unless that subscriber has since told you they do not object.

Do not use, or instigate the use of, a public electronic communications service to make an unsolicited live call for direct marketing purposes to a subscriber who has registered an objection to such calls on that line, or who has told you directly not to call, unless they have since told you they do not object.

Before an outbound telemarketing call to a residential number, screen it against the National Do Not Call Registry and your own do-not-call list, and do not call a number on either.

Before placing a telephone solicitation to a residential number, screen it against the National Do Not Call Registry, refreshed no more than 31 days before the call, and do not call a number on it unless the recipient has an established business relationship with you or has given signed written permission.

Maintain your own written do-not-call policy, train personnel in it, and honor an individual's request not to be called by you again within a reasonable time not to exceed ten business days.

On every solicitation, transmit your telephone number, and your name where your carrier makes it available, through a number at which any individual can ask during regular business hours not to receive solicitations (for a text message, a number that accepts a reply-text opt-out), and do not block that transmission or cause false or misleading caller-identification information to display; the seller's name and customer service number may be substituted.

Do not call or text a number whose occupant has said they do not want solicitations made by or for that seller (for a text message, by replying UNSUBSCRIBE or STOP), and honor that request for at least 10 years; do not call or text a number on the National Do Not Call Registry.

If you are asking for a donation or gift, ask the called party whether they want to continue the call, end it, or be removed from your telephone lists.

End the call within 10 seconds if the called party says they want to end it, or says they do not want to be called again; in the latter case, keep their name and number off your telephone lists for at least one year and do not sell or give their contact information to another company or organization.

Do not send a fax to a recipient, even one with a prior relationship, once they have sent you a written or fax message clearly stating they do not want to receive further faxes from you.

Mark any electronic communication sent for direct marketing as articles 17 and 18 require, identifying its sender and giving the recipient a way to refuse it.

Document your ARCO-POL request procedures, and hold any subcontractor with access to personal data to this Law.

Cease using, or stop providing to a third party, personal data you hold that identifies a person under 16 without delay once the person's request under Article 35(9) is found justified, unless a case Article 35(9) lists applies or ceasing is difficult and you take the alternative measures needed to protect the person's rights and interests (Article 35(10)).

On demand, give a data subject reasonable access to their personal information, its sources and recipients and the manner of processing; correct disputed inaccurate information immediately unless the request is vexatious or unreasonable; and honor a request to suspend, withdraw, block, remove or destroy information that is incomplete, outdated, false, unlawfully obtained or no longer necessary.

Do not process a person's personal data once they have validly objected, including where the processing serves commercial prospecting.

Let a subscriber require you to correct or remove information relating to them, and handle any complaint about how you responded to that request.

Obtain a person's express consent before processing their personal data, unless a specific ground applies such as performing a contract with them, complying with a legal obligation, or a legitimate interest that does not override their privacy rights, and let them object to processing done on public interest or legitimate interest grounds and revoke consent at any time.

Let a consumer inspect the records you hold about them, and correct or remove information shown to be incorrect.

An app that collects, uses, or discloses the personal data of an individual in Sri Lanka, including a voiceprint or faceprint, must have a lawful basis under Schedule I, ordinarily consent, contract necessity, or a legitimate interest satisfying a balancing test, and must give a data subject a way to seek review of a decision based solely on automated processing that has created or is likely to create an irreversible and continuous impact on their rights.

Stop collecting or processing a data subject's personal data if they object, unless the collection or processing falls under one of the section 7(2) grounds.

Let Utah consumers opt out of the sale of their personal data and of processing for targeted advertising.

Respond to a Utah consumer's request to access, delete, correct, or receive a portable copy of their personal data within 45 days, or notify the consumer of a single 45-day extension and the reason for it, and do not charge a fee for a consumer's first request in a 12-month period.

Let a child or adolescent exercise their data-protection rights through their legal representative, and apply any special measure the regulation sets for processing a minor's personal data.

Give every minor user resident in Puerto Rico a simple, understandable process to set their privacy options as part of account registration.

If you are a consumer reporting agency, disclose to a consumer on request the information in the consumer's file, and when the consumer disputes an item, conduct a reasonable reinvestigation free of charge before the end of the 30-day period that begins when you receive the notice, which extends by not more than 15 additional days if you receive relevant information from the consumer during that period.

If you furnish information to a consumer reporting agency, do not furnish information you know or have reasonable cause to believe is inaccurate, and when the agency notifies you of a dispute, investigate, report the results, and modify, delete or permanently block an item found inaccurate, incomplete or unverifiable.

Let a Utah consumer access their genetic data, delete their account and genetic data, and have their biological sample destroyed on request.

Give Utah consumers clear notice and an opportunity to opt out before processing their sensitive data, including biometric data such as a voiceprint, retina scan, iris scan, or fingerprint collected for the purpose of identifying a specific individual.

Honor a consumer's request to confirm, access, or delete their consumer health data within 45 days, extendable once by 45 additional days.