People have the right to find and request access to data held about them by data controllers so that they can understand what is held about them, by whom and correct errors.
United Kingdom: Subject Access Requests give data subjects the right to access their data under the Data Protection Act. They are entitled to know if their personal data is being processed, to receive a description of the data, to receive a copy of the data and to know the details of the source of the data.
European Union: In Article 16 of the General Data Protection Regulation, data subjects are entitled to have their data altered if it’s inaccurate or incomplete. Data controllers must respond within one month, or within two months if the request is complex.
Elsewhere: Most other G20 countries have legislation that allows data subjects to request their personal data and request corrections. Of particular interest, in the United States, the Children’s Online Privacy Protection Act allows parents to view personal data collected by a website about a child and correct or delete it. In the Quebec region of Canada, data controllers cannot charge a request fee.
Data controllers could make it difficult for people to request their data.
Companies may not keep track of who data is shared with and cannot update historic information.