NIST Privacy Framework, Control-PCT.PO-P3

An app that receives a data-subject request from an individual in Bahrain must respond within a fixed working-day deadline, ten or fifteen working days depending on the request type, rather than an open-ended reasonable-time standard.

Honour a data subject's right to object to automated decision-making.

Honour a data subject's rights to access, rectification, erasure, restriction, portability, and objection to direct marketing.

Stop processing personal data for the purposes of direct marketing as soon as the data subject asks you to, with no ground for refusing.

Give a personal data subject, on request and within five working days, information on the processing of their personal data, including your identity, confirmation of processing, the data and its source, and the legal basis and purposes, or explain why you refuse, under Article 11, and rectify personal data that are incomplete, outdated or inaccurate on request.

Require a personal data subject exercising an Article 10 to 13 right to submit a written or electronic application under Article 14, and respond in the same form the application was made unless the subject asks otherwise.

Give a person in Belgium a path to obtain human intervention, express their view, and contest a decision made solely by automated processing that produces a legal or similarly significant effect on them.

Honor a person's request to access, rectify, erase, restrict, port, or object to processing of their personal data in Belgium within one month of receipt.

Respond to a data subject's request to access, rectify, or object to the processing of their personal data, and pass on any correction to any third party the data was disclosed to.

Let a data subject object at any time, on legitimate grounds, to the processing of their personal data, and let them object free of charge and without any justification to processing for direct marketing, charitable, or political prospecting.

Correct, block, erase or destroy personal information on written request where it contains an error or omission.

An ICT or media service provider or vendor in Bhutan must let a user review and, when necessary, have their personal information, including a biometric identifier, amended or removed, and must remove or withdraw information upon the user's request.

Let a person know, object to, and obtain the deletion or rectification of personal data about them that your records or databases hold, when that data affects their right to personal or family privacy, image, honour, or reputation.

Answer a request for access, rectification, erasure, restriction, or portability under Articles 17 to 22, and notify any recipient the data were disclosed to of a rectification, erasure or restriction you make.

Stop processing personal data for direct marketing purposes as soon as a person objects, under Article 23.

Act on a data subject's request to rectify, erase, restrict the processing of, port, or object to the processing of their personal data, and inform the data subject of the outcome without undue delay and, in any event, within one month of receipt of the request, extendable by up to two further months with the Commission's approval.

Let a data subject confirm that processing exists, access their data, correct it, or have it anonymized, blocked, deleted, or ported to another provider, on request.

Tell a data subject which public and private entities you shared their data with, let them object to processing carried out under a consent exemption where it violates this law, and let them revoke consent at any time through a free and easy procedure.

Brunei's Personal Data Protection Order 2025 has granted an individual a right to access personal data an organisation holds about them, including a voiceprint or faceprint, and a right to have inaccurate personal data corrected, since these rights (Part 5) took effect 1 January 2026 under Government Gazette No. S 11/2025. The Order names no separate deletion or data-portability right.

Give a person in Bulgaria a path to obtain human intervention, express their view, and contest a decision made solely by automated processing that produces a legal or similarly significant effect on them.

Honor a person's request to access, rectify, erase, restrict, port, or object to processing of their personal data in Bulgaria within one month of receipt.

Accept a rights request from a person in Bulgaria made in writing, electronically, or through an action in your product's interface once the person is identified, under Personal Data Protection Act Articles 37b and 37v.

Stop processing a person's data on their objection for legitimate reasons, unless you can show an overriding legitimate ground for the processing that outweighs their rights.

Rectify, complete, update, lock or erase personal data at a data subject's written request within two months, notify any third party the data was disclosed to, and carry the burden of proof if you dispute the request.

Let a data subject object, on compelling legitimate grounds relating to their particular situation, to processing you carry out for a public interest or legitimate interest ground, and let them object free of charge and without needing a reason to processing, or a first disclosure to a third party, for direct marketing or other research purposes.

Provide a California consumer a verifiable way to request access to, deletion of, correction of, and a portable copy of their personal information, and respond within the CCPA's statutory timeline.

Honor a Global Privacy Control signal or another recognized opt-out preference signal as a valid request to opt out of the sale or sharing of personal information.

If enacted as drafted, a data controller would have to give a data subject the information article 27 lists before processing their personal data, and act on a request to access, rectify, erase, restrict, receive in a portable form, or object to the processing of their personal data, generally within one month of the request.

If enacted as drafted, a data subject would have the absolute right to object to the processing of their personal data where it is used entirely for direct marketing purposes.

Get a person's prior consent before contacting them with direct marketing by phone, fax, SMS, email, instant message, or social network, and let them unsubscribe or change their preferences at any time.

Give every marketing communication, including one sent to a business or a professional contact, a notice and an unsubscribe mechanism as simple and effective as the original sign up.

Honor a data subject's objection, made on legitimate grounds, to processing of their personal data, including before first communicating it to a third party or using it for prospecting.

Within one month of a written request, rectify, complete, update, block, or erase personal data that is inaccurate, incomplete, equivocal, outdated, or unlawfully held.

Offer a non-personalized option or a convenient opt-out wherever automated decision-making is used to push marketing or commercial information.

Provide an explanation and honor an individual's refusal of a decision made solely by automated means where that decision has a major effect on their rights.

Provide a convenient channel for individuals to access, copy, correct, or delete their personal information, and to request portability to another handler where state conditions are met.

Give a reasoned written explanation whenever a rights request is refused.

Give a data subject the right to know, update and rectify their personal data, request proof of the authorization given, be told on request how their data has been used, revoke the authorization or seek deletion where the processing violates their constitutional or statutory rights, and access their personal data free of charge.

Mark the record with a pending claim legend within two business days of receiving a complete claim for correction, updating or deletion, and resolve the claim within fifteen business days, or fifteen days extendable by eight more days with notice of the delay and a new resolution date.

Put in place pertinent, efficient and demonstrable strategies for an artificial intelligence system to guarantee the data subject rights that Ley 1266 de 2008 and Ley 1581 de 2012 and their implementing decrees establish.

Let a data subject object, on legitimate grounds, to the processing of their personal data.

Let a data subject object, free of charge and without needing to state a reason, to their personal data being used for commercial, charitable or political prospecting.

Give a Connecticut consumer a means to confirm whether you process their personal data, access it, correct it, delete it, and receive a portable copy.

Offer a Connecticut consumer an opt-out of targeted advertising, sale, and profiling in furtherance of decisions with legal or similarly significant effects, and honor a universal opt-out preference signal.

Give a person in Croatia a path to obtain human intervention, express their view, and contest a decision made solely by automated processing that produces a legal or similarly significant effect on them.

Honor a person's request to access, rectify, erase, restrict, port, or object to processing of their personal data in Croatia within one month of receipt.

Honor a person's request to access, rectify, erase, restrict, port, or object to processing of their personal data in Cyprus within one month of receipt.

Give a person in the Czech Republic a path to obtain human intervention, express their view, and contest a decision made solely by automated processing that produces a legal or similarly significant effect on them.

Honor a person's request to access, rectify, erase, restrict, port, or object to processing of their personal data in the Czech Republic within one month of receipt.

Stop processing a person's data for prospecting purposes as soon as they object, free of charge, and tell them before their data are first disclosed to a third party for prospecting so they can object to that disclosure.

Rectify, complete, update, delete or lock personal data on request where it is inaccurate, incomplete, ambiguous or outdated, including at the request of a deceased person's successors.

Give a Delaware consumer a means to confirm whether you process their personal data, access it, correct it, delete it, and receive a portable copy.

Offer a Delaware consumer an opt-out of targeted advertising, sale, and profiling in furtherance of solely-automated decisions with legal or similarly significant effects, and honor universal opt-out preference signals as of January 1, 2026.

Let a data subject object at any time, on legitimate grounds, to processing of their data, offer them that right expressly and free of charge before their data is first communicated to a third party or used for prospecting, and answer an objection within thirty days.

Do not charge a data subject for supplying information or acting on a request, and tell them in writing within thirty days if you do not act on their request.

Honor a person's request to access, rectify, erase, restrict, port, or object to processing of their personal data within one month of receipt, for a person in Denmark.

Correct, update, or suppress inaccurate, incomplete, or outdated personal data on a data subject's request, free of charge, within ten business days of the request or of discovering the error, and notify any recipient the data was disclosed to within five business days of the correction.

Recognize a data subject's independent rights of access, rectification, cancellation, and opposition, and their right to bring a judicial habeas data action to learn of, access, correct, or suppress personal data, without requiring one right to be exercised before another.

Answer a data subject's request for information, access, rectification, updating, erasure, objection, portability or suspension of the processing on the terms articles 12 to 19 set.

Guarantee, at all times, a data subject's right not to be the object of a decision based solely or partly on automated valuations reached by an AI system processing their personal data, along with the right to information and the right to object.

Give a Data Subject, on request, access to their own Personal Data you hold, and let them withdraw consent to its retention or processing, correct, edit, delete, add to or update it, limit the processing to a specified purpose, and object to the processing or its results where it contradicts their fundamental rights and freedoms.

Reply to a request to exercise those rights within six working days of the day it was submitted.

Stop processing a data subject's personal data, including profiling for direct marketing, as soon as they object, unless a listed exception applies, and limit processing on request while a dispute is pending.

Appoint a delegate to manage ARCO-POL requests and answer them within twenty business days, extendable once by another twenty for justified cause, referring an incompetent request within five business days and notifying anyone who received the corrected or deleted data within five business days of granting a request.

Honor a person's request to access, rectify, erase, restrict, port, or object to processing of their personal data in Estonia within one month of receipt.

Give a data subject written reasons where you deny an access request, and let them challenge those reasons.

Correct, destroy, or delete personal information on a data subject's request within fourteen days where it is inaccurate, irrelevant, excessive, out of date, incomplete, misleading, or unlawfully obtained, and tell anyone the changed information was disclosed to within seven working days of the correction where it affects a decision about the data subject.

Stop processing personal data for direct marketing, including the profiling related to it, as soon as the data subject objects, and bring the right to object to the data subject's attention explicitly.

Restrict processing on request in the cases article 30 lists, keep the data stored but otherwise unused without the data subject's consent, and tell the data subject before lifting the restriction.

Where relying on the contract-necessity or explicit-consent exception, implement suitable safeguards, at minimum the right to obtain human intervention, to express a point of view, and to contest the decision.

Honor a data subject's request to access, rectify, erase, restrict, port, or object to processing of their personal data within one month of receipt.

Honor a person's request to access, rectify, erase, restrict, port, or object to processing of their personal data in Finland within one month of receipt, unless a Data Protection Act Section 33 or 34 national security, defence, public order, or tax supervisory ground applies.

Give a qualifying Florida consumer a means to confirm whether you process their personal data, access it, correct it, delete data you provided or obtained about them, and receive it in a portable, readily usable digital format.

Offer a Florida consumer an opt-out of targeted advertising, sale of personal data, profiling producing a legal or similarly significant effect, collection or processing of sensitive data including precise geolocation, and collection of personal data through a voice or facial recognition feature.

Give a person in France a path to obtain human intervention, express their view, and contest a decision made solely by automated processing, including profiling, that produces a legal or similarly significant effect on them.

Honor a person's request to access, rectify, erase, restrict, port, or object to processing of their personal data in France within one month of receipt.

Do not subject a person to a decision based solely on automated processing, including profiling, without letting them oppose it.

Where you make such a decision, implement appropriate measures to safeguard the person's rights, freedoms and legitimate interests, including at least their right to obtain human intervention, express their point of view, and contest the decision.

Respond to a data subject's request to access, rectify, erase, restrict, port, or object to the processing of their personal data.

Act on a data-subject request within one month of receiving it, extendable by two months for complex or numerous requests provided you tell the person of the extension and its reasons within the first month; where you decline to act, tell the person why within one month and of their right to complain to the APDPVP or go to court.

Store personal data without processing it further while its accuracy is contested or another ground for restriction applies.

Cease processing personal data for direct marketing immediately upon request, and weigh any other objection made on grounds relating to the data subject's particular circumstances.

An app holding the personal data of a person in Georgia must give that person a way to withdraw consent and to appeal, and must act on a request to exercise their Chapter III rights on demand.

Honor a person's request to access, rectify, erase, restrict, port, or object to processing of their personal data in Germany within one month of receipt.

Where non-automated storage makes erasing a person's data in Germany impossible or disproportionately costly and their interest in erasure is minor, restrict processing of the data instead of erasing it, unless the data were processed unlawfully, under BDSG Section 35(1).

Give a data subject the right to demand that a decision significantly affecting them is not based solely on automated processing of their personal data, and notify them as soon as reasonably practicable when such a decision is taken without a prior notice.

Reconsider an automated decision within twenty one days of a data subject's written request, and tell them in writing what steps you will take to comply.

Cease or refrain from processing personal data within twenty one days of a data subject's written notice that the processing causes or is likely to cause them unwarranted damage or distress, or give them your reasons for not complying.

Answer a data subject's request to confirm whether you hold personal data about them, describe it, and correct it, promptly and in any event within forty days of receiving the request.

Honor a person's request to access, rectify, erase, restrict, port, or object to processing of their personal data in Greece within one month of receipt.

Give a data subject access to, and let them rectify, their personal data on written request, unless a refusal ground under the Act applies.

State the specific ground for any refusal of access in the written notice, together with the data subject's right to complain to the Commission about the refusal.

A state entity holding records about a person must, on request, disclose what it holds, the purpose for which it is used, and correct, rectify, or update it on request.

Update, rectify or suppress a person's data in your database when they ask, subject to a Habeas Data judicial action.

Give a person in Hungary a path to obtain human intervention, express their view, and contest a decision made solely by automated processing that produces a legal or similarly significant effect on them.

Honor a person's request to access, rectify, erase, restrict, port, or object to processing of their personal data in Hungary within one month of receipt.

For five years after a person in Hungary dies, honor a request to access, rectify, erase, restrict or object to processing of their personal data from someone the deceased authorised, or, failing that, from a close relative, under Information Act (Infotv.) Section 25.

Honor a person's request to access, rectify, erase, restrict, port, or object to processing of their personal data in Iceland within one month of receipt, under Act No. 90/2018.

An Indian data principal's rights to access, correct, complete, update, or erase their personal data, including a stored voiceprint or faceprint, and to nominate another person to exercise these rights, have not yet commenced and are scheduled to take effect 13 May 2027. Once in force, an app must give a data principal a way to exercise these rights against it directly, with escalation to the Data Protection Board available only after the app's own grievance process is exhausted.

Give an Indiana consumer a means to confirm whether you process their personal data, access it, correct it, delete it, and receive a portable copy.

Offer an Indiana consumer an opt-out of targeted advertising, the sale of personal data, and profiling that produces a legal or similarly significant effect.

Give an Iowa consumer a means to confirm whether you process their personal data, access it, delete it, and receive a portable copy. ICDPA does not require you to offer a correction mechanism.

Offer an Iowa consumer an opt-out of sale, targeted advertising, and profiling for solely-automated decisions with legal or similarly significant effects.

Where an Irish enactment authorises or requires a solely automated decision about a person and the decision does not simply grant what they asked for, let them make representations, request human intervention and appeal the decision, and tell them in writing the steps you took and, on appeal, the outcome, under Data Protection Act 2018 section 57.

Honor a person's request to access, rectify, erase, restrict, port, or object to processing of their personal data in Ireland within one month of receipt.

An app holding the personal data of a person in Israel in a database must give that person a way to access their own data, and must act on a request to rectify or delete it, notifying any prior recipient of the correction or deletion.

Give a person in Italy a path to obtain human intervention, express their view, and contest a decision made solely by automated processing that produces a legal or similarly significant effect on them.

Honor a person's request to access, rectify, erase, restrict, port, or object to processing of their personal data in Italy within one month of receipt.

Honor a request about a deceased person's personal data in Italy from someone with their own interest, an agent protecting the deceased, or someone with a family reason worth protecting, unless the deceased forbade it in writing, under Codice Article 2-terdecies.

Stop basing a decision that significantly affects a person solely on the automatic processing of their personal data used to evaluate matters such as performance at work, creditworthiness, reliability or conduct, once that person gives you written notice.

Inform a person as soon as is reasonably practicable where you took such a decision without having received that notice, and give them a written statement within 30 days of the steps you will take where they require you to reconsider it.

Give the data subject, on payment of the prescribed fee, their personal data in an intelligible form together with any information you hold as to its source, or, where technically feasible, transmit it to another data controller in a structured, commonly used and machine-readable format.

Identify in writing, within 30 days of the request, the provision you rely on where you refuse to disclose personal data to the data subject.

An app must let an individual in Jordan object to processing or profiling of their data that is unnecessary, excessive, discriminatory, or unlawful for its stated purpose, must let them obtain erasure or concealment of their data and a portable copy transferable to another controller, and must notify them of any data breach affecting the security or integrity of their data.

An app must let a Kazakhstani data subject learn what personal data is held about them and how it is processed, correct or supplement it, demand it be blocked or destroyed where processing was unlawful, and withdraw consent, including specifically for a cross-border or third-party transfer, within the Law's three and fifteen working day response windows.

Give a Kentucky consumer a means to confirm whether you process their personal data, access it, correct it, delete it, and receive a portable copy.

Offer a Kentucky consumer an opt-out of targeted advertising, the sale of personal data, and significant-effect profiling.

Notify a data subject in writing when a decision about them is based solely on automated processing, including profiling, that produces a legal or similarly significant effect, and allow them to request reconsideration or a new decision that is not based solely on automated processing.

Respond to a data subject's request to access, correct or delete their personal data, and to a data portability request within thirty days.

On commencement, give a data subject, at no expense and without unreasonable delay, confirmation of whether their personal data is being processed and its source, a copy of it in a commonly used electronic format, correction of data that is inaccurate, out of date, incomplete or misleading, and deletion of data the controller is not entitled to retain.

On commencement, let a data subject withdraw consent previously given, or object to processing that rests on voluntary provision with no lawful basis, as easily as they gave it, tell them the consequences of doing so, and promptly stop the processing that relied solely on it.

Answer an access, rectification, erasure, restriction, portability or objection request within one month of receipt, extendable by two further months for complex or numerous requests, and tell the data subject about any extension within the first month.

Restrict processing on request while accuracy is contested, in place of erasure where the data subject prefers restriction, where you no longer need the data but the data subject does for legal claims, or while an objection is being verified, and tell the data subject before lifting the restriction.

Honor a person's request to access, rectify, erase, restrict, port, or object to processing of their personal data in Latvia within one month of receipt.

Let a person object, for legitimate reasons, to the collection and processing of their personal data, including processing for commercial promotion, unless the law obliges you to collect it or they have already agreed to the processing.

Let a person review and object, before the person responsible for processing, to the information and analyses used in the automated processing relating to them that is invoked against them.

Give a data subject written reasons where you deny an access request, and let them challenge those reasons.

Correct, destroy, or delete personal information on a data subject's request within 14 days where it is inaccurate, irrelevant, excessive, out of date, incomplete, misleading, or unlawfully obtained, and tell anyone the changed information was disclosed to within 7 working days of the correction where it affects a decision about the data subject.

Let a person access and update the personal data collected about them, through appropriate technological means.

Do not send a person electronic documents once they have explicitly refused to accept them, and stop processing their personal data once they have explicitly refused it.

Honor a person's request to access, rectify, erase, restrict, port, or object to processing of their personal data in Liechtenstein within one month of receipt.

Where erasing a person's data in Liechtenstein is impossible or disproportionately costly because of how it is processed or stored, and their interest in erasure is low, restrict its processing instead of erasing it, unless the data were processed unlawfully, under DSG Article 35(1).

Honor a person's request to access, rectify, erase, restrict, port, or object to processing of their personal data in Lithuania within one month of receipt.

Give a Louisiana consumer a means to confirm whether you process their personal data, access it, correct it, delete it, and receive a portable copy, once the LDPA takes effect January 1, 2027.

Offer a Louisiana consumer an opt-out of targeted advertising, the sale of personal data, and profiling that produces a legal or similarly significant effect.

Honor a person's request to access, rectify, erase, restrict, port, or object to processing of their personal data in Luxembourg within one month of receipt.

Honour a data subject's request, made on a legitimate ground and free of charge, to object to processing of their data, and stop processing for prospecting purposes as soon as they object to it, without requiring a reason.

Rectify, complete, update, block, or erase inaccurate, incomplete, outdated, or unlawfully held data on request, free of charge, and tell any third party the data were disclosed to of the change.

Honor a data subject's objection, made at any time on legitimate grounds relating to their situation, to the processing of their data, and stop processing that data once the objection is justified.

Give a data subject, on request, the rectification, erasure or blocking of data whose processing does not comply with the Act, in particular because it is incomplete or inaccurate.

If enacted as drafted, a Controller would have to tell a data subject about the processing of their personal data and answer a request to access it, correct it, erase it, restrict its processing, receive it in a portable form, or object to the processing.

Rectify, complete, update, block, or delete inaccurate, incomplete, ambiguous, outdated, or unlawfully processed personal data on a person's written request, justify within thirty days that you have done so, and notify any third party the data were transmitted to of the correction.

Where a processing concerns State security, national defence, or public security, route an access or rectification request to the Autorité de Protection des Données à Caractère Personnel instead of answering it yourself.

Honor a person's request to access, rectify, erase, restrict, port, or object to processing of their personal data in Malta within one month of receipt.

Give a Maryland consumer a means to confirm whether you process their personal data, access it, correct it, delete it, receive a portable copy, and obtain a list of third-party categories it was disclosed to.

Offer a Maryland consumer an opt-out of targeted advertising, sale of personal data, and profiling in furtherance of solely automated decisions with legal or similarly significant effects.

Do not process a person's personal data once they have validly objected, including where the processing serves commercial prospecting.

Tell the person, at the time of collection, who is responsible for the processing, its purpose, the categories of data, whether a reply is mandatory or optional, and any recipients, and let them access, object to, correct, or delete their data on request.

Respond to a data subject's request for access, rectification, erasure or restriction of processing, or an objection to processing.

Let a data subject or their legal representative exercise the ARCO rights (access, rectification, cancellation, and objection) at any time, without requiring one as a precondition of another, and safeguard their personal data so these rights can be exercised without delay.

Communicate your determination on an ARCO request within twenty days of receiving it, give effect to a favourable determination within fifteen days of communicating it, and put any denial in writing with the reasons.

Honor a data subject's right to object to a fully automated decision that produces undesired legal effects or significantly affects their interests, rights, or freedoms, where that decision evaluates, without human intervention, their professional performance, economic situation, health, sexual preferences, reliability, or behaviour.

Give a Minnesota consumer a means to confirm processing, access, correct, delete, and port their personal data.

Offer a Minnesota consumer the right to opt out of automated profiling in furtherance of decisions with legal or similarly significant effects, question the result, receive an explanation, and have the decision reevaluated if based on inaccurate data.

Answer a request for access, rectification, erasure, restriction or portability, and notify every recipient the data was disclosed to of a rectification, erasure or restriction you carry out.

Stop processing personal data for direct marketing as soon as the data subject objects, including the profiling related to it.

Act on a data subject's rights request concisely, understandably, and in an easily accessible form, in clear and plain language, with particular care where the information is meant for a minor, and answer within one month of receipt, extendable by two months for a complex or repeated request.

Restrict processing on request in the listed cases, keep the data stored but otherwise untouched without the person's consent while the restriction lasts, and tell the person before you lift it.

An app must let a Mongolian data subject know whether their data is collected or processed, correct errors, request deletion, obtain and transfer a copy of their own data to a controller of their choosing, and complain about, add information to, or demand reprocessing of a decision that results from processing their data.

Give a Montana consumer a means to confirm whether you process their personal data, access it, correct it, delete it, and receive a portable copy.

Respond to a consumer rights request without undue delay and within 45 days of receipt, with one 45-day extension available, and decide an appeal of a refusal within 60 days.

Supplement, alter or erase inaccurate or incomplete personal data, or block personal data whose use does not comply with the law, within 15 days of a data subject's request, under Article 44.

On a data subject's request, update, rectify, erase, or block personal data whose processing does not comply with the law, free of charge, within ten clear days, and notify anyone the data was disclosed to of the correction.

Honor a data subject's objection to processing on legitimate grounds, and their objection, free of charge, to having their data used for marketing by you or by any later processor.

Where a data subject objects to data concerning them and the objection is accepted, remove, rectify, complete, or alter it.

Give a Nebraska consumer a means to confirm whether you process their personal data, access it, correct it, delete it, and receive a portable copy.

Respond to a consumer rights request without undue delay and within 45 days of receipt, with one 45-day extension available.

Give a person in the Netherlands a path to obtain human intervention, express their view, and contest a decision made solely by automated processing that produces a legal or similarly significant effect on them, subject to UAVG Article 40's exceptions.

Honor a person's request to access, rectify, erase, restrict, port, or object to processing of their personal data in the Netherlands within one month of receipt.

Give a Nevada consumer the right to access their consumer health data, obtain a list of third parties it was disclosed to, stop its collection, sharing, or sale, and delete it.

Respond to a consumer health data rights request within 45 days, with one 45-day extension available, and provide at least two free responses per consumer per year.

Honor a Nevada consumer's request not to sell their covered information (name, address, email, phone, Social Security number, or similar contact identifiers maintained in personally identifiable form).

Give a New Hampshire consumer a means to confirm whether you process their personal data, access it, correct it, delete it, and receive a portable copy.

Offer a New Hampshire consumer an opt-out of targeted advertising, the sale of personal data, and profiling with legal or similarly significant effects.

Give a New Jersey consumer a means to confirm, access, correct, delete, and port their personal data, and respond within 45 days of receipt (extendable once by 45 days).

Recognize a user-selected universal opt-out mechanism for targeted advertising and sale of personal data. This duty became operative around July 15, 2025, separately from NJDPA's general effective date.

Rectify, modify, suppress, complement, include, update, or cancel a data subject's personal data on request within five business days, notify any assignee of the correction within five business days, block the disputed data while you verify a claimed error, and do this free of charge; you may refuse only where a judicial decision orders you not to modify the data, and you must then tell the data subject of that decision.

Include personal data in a file built for advertising, promotions, offers, or direct sale only with the data subject's consent or from a publicly accessible source, give the data subject free access to it, and let them request removal from it at any time.

Correct, complete, update, lock or erase inaccurate, incomplete, ambiguous or outdated data within one month of a request from the person or a deceased person's heirs.

Do not use a person's data for direct marketing without their prior consent, and stop processing their data for direct marketing, free of charge, as soon as they object, telling them of that right before you first use or disclose their data for that purpose.

Honor a person's request to access, rectify, erase, restrict, port, or object to processing of their personal data in Norway within one month of receipt.

Give an Oklahoma consumer a means to confirm whether you process their personal data, access it, correct it, delete it, and receive a portable copy in a digital format.

Offer an Oklahoma consumer an opt-out of targeted advertising, the sale of personal data, and profiling that produces a legal or similarly significant effect.

An app must let an individual in Oman revoke their consent, request amendment or blocking of their data, obtain a copy of it, transfer it to another controller, request its erasure (unless national archiving requires otherwise), and must notify them of any breach or infringement of their personal data and the actions taken in response; these rights apply to a voiceprint, faceprint, or other biometric identifier like any other personal data.

Give an Oregon consumer a means to confirm whether you process their personal data, disclose the categories processed, provide a portable copy, correct it, and delete it.

Offer an Oregon consumer an opt-out of targeted advertising, sale, and profiling for decisions with legal or similarly significant effects.

Correct, cancel, or stop processing a data subject's personal data on request when it is incorrect, irrelevant, incomplete, outdated, inaccurate or false, and let them revoke consent.

Answer an access request within ten business days free of charge, and complete a correction, blocking, or deletion within five business days of the request.

Let a data subject ask for review of a decision based on automated processing of their personal data that adversely affects their interests or produces legal effects, express their point of view and contest it, and on request give them clear, complete information about the criteria and procedures the decision used.

Honor a data subject's rights of access, rectification, deletion, objection and portability, free of charge.

Answer a request under articles 28 to 32 on the terms article 26 sets for the exercise of those rights.

Correct, update, include, or delete a person's personal data on request when it is inaccurate, incomplete, or has outlived the purpose or period for which it was collected, tell anyone you previously transferred it to about the change, and block the data from third-party access while the request is pending.

Stop supplying a person's personal data to others on their request to prevent supply, especially where the supply would affect a fundamental right.

An app holding the personal information of an individual in the Philippines must give that individual a way to be informed, object, access, correct, and erase their data, and must provide a copy of their data in a structured, commonly used, machine-readable format on request.

Give a person in Poland a path to obtain human intervention, express their view, and contest a decision made solely by automated processing that produces a legal or similarly significant effect on them.

Honor a person's request to access, rectify, erase, restrict, port, or object to processing of their personal data in Poland within one month of receipt.

Honor a person's request to access, rectify, erase, restrict, port, or object to processing of their personal data in Portugal within one month of receipt.

On the person's request, disclose the personal information used to reach the decision, the reasons and the principal factors and parameters that led to it, and their right to have that personal information corrected.

Give the person an opportunity to submit observations to a staff member who is in a position to review the automated decision.

Let a data subject object to processing of their personal data on legitimate grounds, and tell them, before their data is first communicated to or used by a third party for prospecting, of their free right to object to it.

Answer a request for rectification, completion, updating, blocking or erasure of inaccurate, incomplete, ambiguous, outdated or unlawfully processed personal data within one month of registering it, free of charge.

Give a Rhode Island customer a means to confirm whether you process their personal data, access it, correct it, delete it, and receive a portable copy.

Offer a Rhode Island customer an opt-out of targeted advertising, the sale of personal data, and significant-effect profiling.

Give a person in Romania a path to obtain human intervention, express their view, and contest a decision made solely by automated processing that produces a legal or similarly significant effect on them.

Honor a person's request to access, rectify, erase, restrict, port, or object to processing of their personal data in Romania within one month of receipt.

Explain to the data subject how such a decision is made and its possible legal consequences, let them object and explain how they can protect their rights, and consider an objection within thirty days and tell them the result.

Honor a Russian data subject's request for confirmation of processing, correction, deletion, or consent withdrawal, under Federal Law No. 152-FZ.

Within thirty days of a request to object, port, erase or rectify personal data, tell the data subject in writing or electronically whether you complied and, if not, why, and expect the supervisory authority to answer an appeal against your response within sixty days.

Stop processing a data subject's personal data on their objection, including for direct marketing or related profiling, unless you can demonstrate compelling legitimate grounds that override their interests, rights and freedoms.

Give written notice of your access decision within thirty days of a data subject's request, or notify an extension of up to thirty days in the circumstances the Act lists, and tell the data subject of their right to complain to the Information Commissioner.

Refuse an access request only where you lack information to identify the requester or locate the data, compliance would breach an exemption or a duty of confidentiality, another identifiable individual has not consented to disclosure, or the Information Commissioner has not approved the refusal in writing.

Once Part 5 is in force, correct inaccurate personal data on request and stop processing a person's personal data for direct marketing on their objection.

On a registered person's request, correct or, where correction is not feasible, delete personal data that is inaccurate, out of date, incomplete, or misleading, or that the National Digital Identification System or relying party is not entitled to retain.

Implement measures that let a registered person effectively exercise these access, correction, and information rights, and provide a way to lodge a grievance over improper use of their data.

Answer a request for access, rectification, erasure, restriction or portability, and notify every recipient the data was disclosed to of a rectification, erasure or restriction you carry out.

Stop processing personal data for direct marketing as soon as the data subject objects, including the profiling related to it.

Answer a data holder's request, free of charge, at reasonable intervals and without undue delay, with confirmation of whether you are processing their data, the purposes, the categories of data and recipients, the data itself in an intelligible form, its origin, and the reasoning behind any automated processing decision about them, and correct, erase or block data that does not comply with this Law.

Let a data holder object, for weighed and legitimate reasons relating to their particular situation, to your continued processing of their data, and stop processing their data for direct marketing or another commercial solicitation, free of charge, as soon as they object or before you first communicate their data to a third party for that purpose.

Tell the person, at the time of collection, who is responsible for the processing, its purpose, the categories of data, whether a reply is mandatory or optional, and any recipients, and let them access, object to, correct, or delete their data on request.

Let a person object, free of charge and for legitimate reasons, to processing of their data, and correct, complete, update, block, or delete it within one month of a written request where it is inaccurate, incomplete, ambiguous, outdated, or unlawfully processed, notifying any third party the data was disclosed to.

Restrict processing on request while accuracy is disputed, the processing is unlawful but the person opposes erasure, you no longer need the data but the person needs it for a legal claim, or an objection is pending.

Stop processing a person's data for direct marketing, including related profiling, the moment they object, and tell them about this right clearly and separately no later than your first contact with them.

Give a data subject access to, and the ability to correct or delete, their personal data on request.

An app holding the personal data of an individual in Singapore must give that individual a way to access and correct their personal data on request.

Give a person in Slovakia a path to obtain human intervention, express their view, and contest a decision made solely by automated processing that produces a legal or similarly significant effect on them.

Honor a person's request to access, rectify, erase, restrict, port, or object to processing of their personal data in Slovakia within one month of receipt.

Give a person in Slovenia a path to obtain human intervention, express their view, and contest a decision made solely by automated processing that produces a legal or similarly significant effect on them.

Honor a person's request to access, rectify, erase, restrict, port, or object to processing of their personal data in Slovenia within one month of receipt.

On request, confirm whether you process a person's personal data and where it came from, give them a copy in a commonly used electronic format, and correct or delete data that is inaccurate, out of date, incomplete or misleading, at no expense and without unreasonable delay.

Stop processing personal data a data subject validly objects to, unless a public interest or other legitimate ground outweighs the unwarranted damage or distress.

Correct or delete personal information a data subject shows is inaccurate, irrelevant, out of date, incomplete, misleading or unlawfully obtained, and tell the data subject what action you took.

Do not process personal information for direct marketing by electronic communication unless the data subject has consented, or is an existing customer given a free and simple chance to opt out at collection and on every marketing contact afterward.

Apply default privacy settings and limit profiling, targeted advertising, and precise-geolocation collection for a known minor user, and provide parental controls.

An app must let a Korean data subject confirm whether their personal information is being processed, and give them a way to access, correct, or delete it, or to demand that its processing be suspended.

An app that makes a decision about a Korean data subject using a fully automated system, including one applying artificial intelligence, that significantly affects the subject's rights or obligations, must let the subject object to or request an explanation of the decision, must not apply the decision over an objection absent a compelling reason or must reprocess it with human involvement, and must disclose the criteria and procedures it uses for automated decisions.

Give a person in Spain a path to obtain human intervention, express their view, and contest a decision made solely by automated processing that produces a legal or similarly significant effect on them.

Give a person in Spain a path to exercise access, rectification, erasure, restriction, portability, and objection rights under LOPDGDD Articles 11-18.

An app must give a data subject in Sri Lanka a way to access, withdraw consent for, rectify, or erase their personal data, including a stored voiceprint or faceprint, and must respond to a written request within one month, extendable by up to two further months with notice; a refusal is appealable to the Data Protection Authority.

Let a data subject obtain confirmation that you are processing their personal data, and on request give them the reasons underlying a decision produced by processing their data.

Let a data subject object at any time to processing on grounds relating to their situation, and stop processing their personal data for direct marketing and any related profiling outright as soon as they object to it.

Give a person in Sweden a path to obtain human intervention, express their view, and contest a decision made solely by automated processing that produces a legal or similarly significant effect on them.

Honor a person's request to access, rectify, erase, restrict, port, or object to processing of their personal data in Sweden within one month of receipt.

Honor a Swiss data subject's request for access, rectification, deletion or destruction, or objection to processing, and provide portability for data they gave you and that you process by automated means, under FADP Articles 25 to 32.

Tell a data subject, on request, the nature, purpose and method of processing their personal data and the retention period or how it is set, and let them access their own data, withdraw a prior consent without retroactive effect, correct, delete, add to or update it, confine your processing to a defined purpose, and object to processing that violates their constitutional rights.

Answer any other request from a data subject to exercise a right under this law within seven working days of its submission.

An app must notify a Tajikistani data subject of the personal data collected about them and let them correct inaccurate or misleading data. An app that transfers a subject's data to a third party must notify the subject within three working days, naming the recipient, the purpose, and the data's source, unless the subject already consented to the transfer.

When a data subject requires it, ensure that a decision significantly affecting them is not based solely on automatic processing; where such a decision is made, notify them as soon as practicable and reconsider it if they ask, unless the decision is necessary for a contract with them, authorised by written law, or based on their explicit consent.

On a data subject's request, tell them whether you are processing their personal data, and describe the data, the purposes of the processing and the recipients it is or may be disclosed to.

Suspend or do not begin processing a data subject's personal data when they require it because the processing is likely to cause substantial damage to them or to another person, unless an exception in the Act applies.

Give a Tennessee consumer a means to confirm, access, correct, delete, and port their personal information, and offer an opt-out of targeted advertising, sale, and certain profiling.

Respond to a consumer rights request within 45 days of receipt (extendable once by 45 days) and to an appeal of a denial within 60 days of receipt.

Give a Texas consumer a means to confirm whether you process their personal data, access it, correct it, delete it, and receive a portable copy.

Offer a Texas consumer an opt-out of targeted advertising, the sale of personal data, and profiling that produces a legal or similarly significant effect.

Let a data subject object, on legitimate grounds, to the processing of their personal data, and tell them before their data is first disclosed to or used by a third party for prospecting, offering a free right to object to it, unless the processing meets a legal obligation.

Correct, complete, update, lock or delete personal data on a data subject's written request within one month and at no cost, when it is inaccurate, incomplete, ambiguous, outdated or unlawfully held, and notify any third party the data was disclosed to.

On request, confirm whether you process a data subject's personal information and where it came from, give them a copy in a commonly used electronic format, and correct or delete information that is inaccurate, out of date, incomplete or misleading, without constraint or unreasonable delay and at no expense.

Act on a written request to stop processing personal information for direct marketing as soon as reasonably practicable, and in any event within 30 days of receiving it.

Once Part IV is in force, respond to an individual's access request against your organisation the same way a public body must under Part III, and follow whatever access, correction, and complaint procedure your mandatory code of conduct states.

Let the person consult, correct, complete, rectify, update, clarify or erase their own personal data, and give them a copy in clear language and, where it was processed automatically, an intelligible form, free of charge, within one month of their request.

Offer an electronic channel for a rectification, modification, correction or erasure request where you process personal data by automated means.

An app must give a person in Turkey a way to learn whether their personal data is processed, access information about that processing, and request correction or erasure.

An app must let a person in Turkey object to a result against them that arises from analysis of their data solely through automated systems.

Correct or delete personal data on a data subject's request where it is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or obtained unlawfully, tell the data subject the outcome, and notify every person the data was previously disclosed to of a correction made.

Stop processing personal data within fourteen days of a data subject's written notice that the processing causes or is likely to cause them unwarranted substantial damage or distress, unless the processing falls under section 7(2), and comply within seven days if the Authority orders you to.

Once enacted, give a data subject in Ukraine the right to restriction of processing of their personal data.

Give parents a way to review and delete a child's collected personal information.

Correct, update, include, or delete a data subject's personal data within five business days of their request when it is erroneous, false, or missing, or explain in writing why it does not, and notify any recipient of the data of the correction within five business days.

On request, remove or block a data subject's data from a marketing, canvassing, or profiling database at any time, free of charge.

As a motor vehicle manufacturer selling or leasing vehicles in Utah, once in effect, provide in-vehicle privacy controls letting a consumer view what personal data categories the vehicle collects and shares, opt out of sale or targeted-advertising processing, and delete readily accessible data stored locally on the vehicle.

An app must let an Uzbek data subject learn whether their data is held and processed, obtain information on access conditions, consent to or withdraw from inclusion in public sources, and suspend processing on request where the data is incomplete, outdated, or unreliable.

On a data subject's request, correct or erase inaccurate, unlawfully processed or no longer necessary personal data, and restrict processing in the circumstances section 10 lists.

Let a data subject object to the processing of their personal data.

Where this Regulation binds your processing, let the Interested party exercise the right to access, rectify, erase, port and restrict the treatment of personal data you hold about them, by written or electronic request to the Data Controller.

Update, correct, or delete a person's data on their request to the competent court if it is erroneous or illegitimately affects their rights.

Once in force, give a Vermont consumer access, correction, deletion, portability, opt-out of targeted advertising and sale, a profiling explanation and reevaluation right for housing decisions, and a list of third parties their data was sold to.

Respond to a consumer rights request without undue delay and not later than 45 days after receipt, with one 45-day extension available, once the Act takes effect.

Give a Virginia consumer a means to confirm whether you process their personal data, access it, correct it, delete it, and receive a portable copy.

Offer a Virginia consumer an opt-out of targeted advertising, the sale of personal data, and profiling that produces a legal or similarly significant effect.

Let a data subject access, correct, delete, or restrict the personal data held about them.

Stop processing personal data for direct marketing as soon as the data subject objects, and bring the rights of objection to their attention clearly and separately at your first communication with them.

Give a data subject notice of who is responsible for processing and why, and let them access, object to, correct, or have deleted false or misleading personal data about them.

If you sell or use an automatic telephone dialing system in Massachusetts, defined as terminal equipment that stores or produces telephone numbers using a random or sequential number generator and can deliver a prerecorded message, design and operate it to prevent dialing any number a customer has asked their own common carrier not to call, and to automatically release the called party's line within five seconds after they hang up.

If you are a common carrier, let a customer notify you, at no charge, that they do not wish to receive automatic-dialing-system calls, and offer that opportunity when their telephone is installed and at least once a year afterward.

Do not place an unsolicited telephonic sales call to a consumer whose name and telephone number appear on the office's current no sales solicitation calls listing, call between 8 p.m. and 8 a.m. local time at the consumer's location, send the solicitation by fax, or use a recorded message device.

Do not make a telephone solicitation to a residential telephone subscriber whose name and number are on the federal do-not-call list, or to a consumer who has asked not to receive calls from or for your organization, and use the do-not-call list for no other purpose.

Do not telemarket to a Montana residence before 8 a.m. or after 9 p.m. local time, call someone who has said they do not wish to receive solicitation calls from you, use threatening, intimidating, profane or obscene language, engage anyone in conduct a reasonable person would find annoying, abusive or harassing, or intentionally block caller identification (an accurate substitute name and a working number are allowed).

Do not make a telephone solicitation (a voice call from a live operator or an automatic dialing-announcing device encouraging a purchase, rental or investment) to a Montana residential subscriber listed on the state no-call database, unless the subscriber invited it, has had business contact with you in the past 180 days or has a current business or personal relationship with you, or another listed exception applies (a 501(c)(1) to (c)(6) organization's fundraising call by a bona fide member, a federally regulated caller with its own no-call list, a natural person's referral or home-based call, or a licensed professional setting an appointment).

Do not make an unsolicited call for the sale of goods or services to a number on the currently effective registry list, unless you have a preexisting business relationship with that person (a purchase or other financial transaction directly with you within the preceding 18 months), keep an internal do-not-call registry of people who asked you not to call, and send each such customer an annual written notice explaining how to join it.

Do not make a telemarketing sales call, one made to induce payment or an extension of credit for goods or services or to gather information for such a solicitation, to a New Hampshire customer who has registered with the national do-not-call registry, and obtain the registry's quarterly listings.

Do not make or cause to be made an unsolicited telemarketing sales call or message, including a cellular telephone text message, to a consumer more than thirty days after that consumer's telephone number first appears on the Attorney General's no-telemarketing-sales-call registry, unless you have an established business relationship with the consumer or the number has since been removed from the registry.

Before using an automatic dialing and announcing device to call a subscriber, design or operate it to disconnect within 10 seconds after the subscriber ends the call, and to offer the subscriber a one-touch or one-digit method within the first 10 seconds to opt out of future calls from you, unless you are a collection agency, debt buyer, debt collector, a public safety or law enforcement representative, or you have an established business relationship with the subscriber.

Do not use such a device to dial a fire, law enforcement or other emergency agency, a hospital, health care facility, physician's office, poison control center, or suicide-prevention or domestic-violence counseling service; do not dial a subscriber who used the device's opt-out against you unless you are a collection agency, debt buyer or debt collector, a public safety or law enforcement representative, or have an established business relationship; and, when dialing randomly or sequentially, do not dial a subscriber on an official government do-not-call list unless you have an established business relationship, are a debt buyer or subject to the Fair Debt Collection Practices Act, are a public safety or law enforcement representative, or are a school district or school calling its employees, students or their families.

Before placing a telephone solicitation call, screen it against the current list published by the administrator of Oregon's telephone solicitation program, which may include the part of the federal do-not-call registry relating to Oregon, and do not call a number on that list.

Do not knowingly, or while consciously avoiding knowledge, provide substantial assistance or support, including carrying or facilitating calls, for another person's violation of this registry ban, unless you are a common carrier or a network operator on whose network the call merely terminates.

Once a party you call or text as part of a telephone solicitation states a desire not to be called or texted again, do not make a subsequent telephone solicitation of that party at that number.

Do not make a telephone solicitation, including a text message or ringless voicemail, on a Sunday, on a legal holiday, or before 9 a.m. or after 7 p.m., or to a subscriber who has told you they do not want solicitations from you or your seller (for a text message, a reply such as stop, quit, end, revoke, opt out, cancel or unsubscribe), or to a number on the do-not-call list once 30 days have passed since the quarterly list that first contains it; obtain the list quarterly and use it only to remove numbers.

If you use robocalls, state at the start of each call how to opt out, offer an automated voice or key-press opt-out within two seconds of identifying the caller and the seller and throughout the call, remove an opting-out number immediately, never require written consent to opt out, and leave a toll-free number reaching that opt-out in any voicemail message.

Do not make a telemarketing call (an unsolicited call, text message included, to solicit a sale of a consumer good or service, credit for one, or information for either) to a number more than 60 days after it appears on the Texas no-call list.

When you make a facsimile solicitation from Texas, include in at least 12-point type your complete name and street address and a toll-free or local number answered by a person on weekdays from 9 a.m. to 5 p.m. or that automatically deletes the recipient's number; on a stop request, send a written acknowledgment within 24 hours and make no further transmission to that number.

Do not transmit, or instigate the transmission of, an unsolicited direct-marketing fax to an individual subscriber unless they have consented, to a corporate subscriber who has told you not to, or to any subscriber whose number is listed on the fax-marketing register the Information Commissioner keeps, unless that subscriber has since told you they do not object.

Do not use, or instigate the use of, a public electronic communications service to make an unsolicited live call for direct marketing purposes to a subscriber who has registered an objection to such calls on that line, or who has told you directly not to call, unless they have since told you they do not object.

Before an outbound telemarketing call to a residential number, screen it against the National Do Not Call Registry and your own do-not-call list, and do not call a number on either.

Let a called party revoke consent at any time by any reasonable method, including replying STOP to a text or using an automated opt-out mechanism on a call, and stop further robocalls and robotexts to that number within a reasonable time not to exceed ten business days of the request.

Before placing a telephone solicitation to a residential number, screen it against the National Do Not Call Registry, refreshed no more than 31 days before the call, and do not call a number on it unless the recipient has an established business relationship with you or has given signed written permission.

Maintain your own written do-not-call policy, train personnel in it, and honor an individual's request not to be called by you again within a reasonable time not to exceed ten business days.

On every solicitation, transmit your telephone number, and your name where your carrier makes it available, through a number at which any individual can ask during regular business hours not to receive solicitations (for a text message, a number that accepts a reply-text opt-out), and do not block that transmission or cause false or misleading caller-identification information to display; the seller's name and customer service number may be substituted.

Do not call or text a number whose occupant has said they do not want solicitations made by or for that seller (for a text message, by replying UNSUBSCRIBE or STOP), and honor that request for at least 10 years; do not call or text a number on the National Do Not Call Registry.

If you are asking for a donation or gift, ask the called party whether they want to continue the call, end it, or be removed from your telephone lists.

End the call within 10 seconds if the called party says they want to end it, or says they do not want to be called again; in the latter case, keep their name and number off your telephone lists for at least one year and do not sell or give their contact information to another company or organization.

Do not send a fax to a recipient, even one with a prior relationship, once they have sent you a written or fax message clearly stating they do not want to receive further faxes from you.

Document your ARCO-POL request procedures, and hold any subcontractor with access to personal data to this Law.

Give a person access to their own data within twelve months of a request, and rectify or cancel inaccurate or incomplete data within fifteen days of a request.

Honor a request made through, or equivalent to, RIA's Data Tracker service for an overview of operations performed on a person's data by a public-sector controller connected via X-Road, as an implementation of the GDPR Article 15 access right.

Do not process a person's personal data once they have validly objected, including where the processing serves commercial prospecting.

Let a subscriber require you to correct or remove information relating to them, and handle any complaint about how you responded to that request.

Obtain a person's express consent before processing their personal data, unless a specific ground applies such as performing a contract with them, complying with a legal obligation, or a legitimate interest that does not override their privacy rights, and let them object to processing done on public interest or legitimate interest grounds and revoke consent at any time.

Let a consumer inspect the records you hold about them, and correct or remove information shown to be incorrect.

An app that collects, uses, or discloses the personal data of an individual in Sri Lanka, including a voiceprint or faceprint, must have a lawful basis under Schedule I, ordinarily consent, contract necessity, or a legitimate interest satisfying a balancing test, and must give a data subject a way to seek review of a decision based solely on automated processing that has created or is likely to create an irreversible and continuous impact on their rights.

Stop collecting or processing a data subject's personal data if they object, unless the collection or processing falls under one of the section 7(2) grounds.

Let Utah consumers opt out of the sale of their personal data and of processing for targeted advertising.

Respond to a Utah consumer's request to access, delete, correct, or receive a portable copy of their personal data within 45 days, or notify the consumer of a single 45-day extension and the reason for it, and do not charge a fee for a consumer's first request in a 12-month period.

The federal CAN-SPAM Act's preemption clause supersedes a state statute that expressly regulates commercial email except to the extent it prohibits falsity or deception, and the following duty is not framed as such a prohibition: when sending an unsolicited commercial electronic mail message to a recipient with whom you have no consent and no established business relationship, mark the first characters of its subject line "ADV:", or "ADV-ADULT:" for sexually explicit content, and give the recipient a free, working way to opt out of future messages; this does not reach a message you send only to your own members, employees, or contractors.

Once a person who has received unsolicited and unwanted advertising material for the sale of real estate, goods or services on a facsimile machine gives you written notice to discontinue, do not use a facsimile machine to send that person unsolicited advertising material for the sale of real estate, goods or services for one calendar year from the date of the notice.

Operate a valid return email address or toll-free telephone number that the recipient of an unsolicited commercial email or fax can use to tell you to stop sending them.

For an unsolicited commercial electronic mail message, put "ADV:" first in the subject line, or "ADV: ADULT ADVERTISEMENT" if it contains obscene material or material depicting sexual conduct, and provide a functioning return email address to which the recipient can send a removal request at no cost; remove the address within three days after receiving the request.

Do not sell or otherwise provide to anyone the email address of a person who has asked to be removed, except as other law requires.

You do not need consent if you obtained the recipient's contact details in the course of a sale or sale negotiation with them, you market only your own similar products or services, and you gave the recipient a simple, free means of opting out at the time the details were collected and with every later message.

From 5 February 2026, a charity does not need consent to email or text someone to further its own charitable purposes if it obtained their details because they expressed an interest in, or offered or gave support to, those purposes, and gave them a simple, free means of refusing at collection and with every later message.

Every commercial email must carry accurate header and routing information, a subject line that is not deceptive about the message's contents, clear and conspicuous identification that the message is an advertisement unless the recipient gave prior affirmative consent, a functioning return address or other opt-out mechanism, and a valid physical postal address of the sender.

Honor an opt-out request within 10 business days, and do not sell, lease, or transfer the recipient's address after receiving the request except to a person retained to help you comply with it.

Stop sending further messages to that address within 10 days of a request to stop, and provide a cost-free, clearly identified opt-out mechanism in every message.

Honor a consumer's request to confirm, access, or delete their consumer health data within 45 days, extendable once by 45 additional days.