Find your next favorite thing at Technopolicy

Technopolicy

Subscribe

Data Privacy Laws and Rights

By

Valerie Kilbride

data privacy laws explained
Law or rule What the evidence supports Planning use
GDPR Applies when a non-EU organisation collects or uses an EU citizen’s data. Requires clear opt-in consent. Rights include access, rectification, erasure, restriction, portability, objection and protection from solely automated decisions. If an organisation anywhere handles your data as an EU citizen, expect these rights. Businesses outside Europe should check their exposure.
CCPA, as amended by CPRA Users can access and request deletion of their data and can opt out of processing, sale or sharing. CPRA adds correction and limits on sensitive data use. Use the opt-out and deletion routes first for services that fall under California law.
Other US state laws There is no single federal privacy law, so businesses face a patchwork of state laws. Confirm which state’s law covers you before assuming a particular right exists.
HIPAA Security Rule Contains provisions for encryption and robust authentication for data access control. Anyone handling health data should treat encryption and strong authentication as baseline controls.

The rights and rules above come from a compliance guide to privacy regulations and a US state privacy law overview.

Data privacy laws explained in practice: GDPR gives people rights of access, rectification and erasure, while CCPA centres on access, deletion and opting out of sale. Which law applies depends on whose data is handled and where.

If you want the conceptual split between keeping data private and keeping it secure, Data Protection Vs Data Privacy: How They Differ, Why Both Matter, And What To Do About It (2026 Guide) – Technopolicy covers it. The sections below move from legal rights to the security habits that make those rights worth having.

Choosing where to start

The right starting point depends on whether you are exercising rights, running an organisation that holds other people’s data, or handling a sensitive category such as health records. Privacy law is not one rulebook. A person in California, a customer of a European company and a patient whose records are covered by HIPAA each stand under different rules.

If you are an individual

If you run a business

If special data or other jurisdictions are involved

GDPR: rights, consent and duties

GDPR is a rights-based regime built around the individual. It applies when a non-EU organisation collects or uses an EU citizen’s data, as the Novatech compliance guide notes, so a company’s headquarters do not decide whether you are protected.

What rights does GDPR give me?

GDPR gives you a set of rights over personal data held about you. The rights listed in that guide are:

  • Access. You can ask to see the data an organisation holds about you. This is usually the right to use first, because it shows what else to challenge.
  • Rectification. You can ask for inaccurate data to be corrected. It matters when decisions, such as credit or account checks, rest on wrong records.
  • Erasure. You can ask for your data to be deleted. This suits accounts you no longer use.
  • Restriction. You can ask an organisation to limit how it uses your data. It is a middle path when you want to challenge data without deleting it.
  • Portability. You can ask to move your data elsewhere. It helps when switching providers.
  • Objection. You can object to certain processing of your data.
  • No solely automated decisions. You are protected against decisions made only by automated means. This matters most where algorithms score or screen people, a theme explored in AI And Privacy Concerns: What You Need To Know In 2026 – Technopolicy.

Pick the right with the narrowest effect that solves your problem. Access first if you do not know what is held. Erasure when you want to leave. Rectification when something is wrong. Some rights may have conditions or exceptions that this overview does not detail, so read the organisation’s reply carefully and follow up if it is incomplete.

Consent and what counts as valid

GDPR consent has to be opt-in. As the Novatech guide puts it, an organisation cannot use opt-out or assume consent. A separate regulations guide adds that consent must be explicit and that the process must be clear and distinguishable. For you, that means a pre-ticked box or silent acceptance is not what the law describes. If a consent banner makes accepting easy but refusing hard, you have reason to question whether the process meets that standard.

Duties that sit on organisations

Several obligations explain why the rights above are enforceable in practice:

  • Data protection officer. A complete guide to data privacy states that appointing a DPO to oversee data protection strategy and compliance is a legal requirement for organisations subject to GDPR.
  • Data minimisation. Only the amount of personal data needed for the intended purpose should be collected and processed. Ask why a service wants more than it needs.
  • Integrity and confidentiality. Personal data must be processed in a manner that ensures appropriate security. This principle links privacy law to the security measures covered later.
  • Breach reporting. GDPR mandates strict reporting requirements in case of data breaches, according to Randtronics.

A business outside Europe should not read these duties as optional because it has no EU office. Check whether you collect or use EU citizens’ data at all, then decide whether a DPO and consent redesign are needed.

CCPA, CPRA and the US state patchwork

CCPA, as amended by CPRA, is described as the most expansive US state data privacy law in the Founders Legal overview. It is still a state law. The same overview stresses that with no single federal privacy law, businesses must comply with a patchwork of state rules, which is why you cannot assume a California right exists elsewhere.

Rights under CCPA and CPRA

Under the state laws described there, users can access and request deletion of their data, and can opt out of the processing, sale or sharing of personal information. CPRA amends and expands CCPA by adding rights such as correction and limiting the use of sensitive data. In practice, an opt-out request is the quickest step for stopping data sale or sharing. Deletion is the step for leaving a service. Correction and sensitive-data limits matter if you are dealing with a business whose records about you are wrong or unusually personal.

How does CCPA differ from GDPR?

The core difference is the consent model. GDPR requires opt-in consent. CCPA does not require prior consent for collection and instead emphasises the consumer’s right to opt out of the sale of data. The table below sets the two side by side.

Question GDPR CCPA
Is consent needed before collection? Yes. Clear opt-in consent is required, and opt-out or assumed consent is not acceptable. No prior consent is required for collection.
What is the headline right? A broad list: access, rectification, erasure, restriction, portability, objection and protection from solely automated decisions. The right to opt out of the sale of data.
How must consent or choice be presented? The consent process must be clear and distinguishable. The choice is framed as an opt-out right rather than a consent gate.
Reach and exposure Applies when a non-EU organisation collects or uses an EU citizen’s data. The act allows lawsuits where data is found to be nonencrypted or nonredacted.

The comparison draws on the data protection regulations guide and the Novatech privacy regulations guide.

For you as an individual, the difference changes your first move. Under GDPR you can challenge whether consent was valid at all. Under CCPA you act after the fact, by opting out of sale or sharing. A business serving both audiences needs two consent flows, not one. The full business-side comparison is in GDPR vs CCPA: What Businesses Need To Know In 2026 – Technopolicy.

Beyond California

Because the US has no single federal privacy law, state statutes fill the gap, and each has its own scope. The texas data privacy and security act and the Washington health data statute linked earlier are examples of how states legislate separately. If you work across states, read the individual guides rather than generalising from California, and see US Cybersecurity Laws: A Practical Guide For Businesses And Individuals (2026 Update) – Technopolicy for the security side of US law.

What happens after a data breach

After a data breach, the law shifts attention to what the organisation reports and how well it protected the data in advance. The two regimes in this guide handle this differently, and neither removes your own role in limiting harm.

Duties and legal exposure for organisations

GDPR mandates strict reporting requirements in case of data breaches. Under CCPA, there is an option within the act to bring lawsuits if data is found to be nonencrypted or nonredacted. Put plainly, encryption decides how serious a breach can be legally. Organisations that protect data appropriately reduce both the chance of a breach and their exposure afterward. Notification duties differ by jurisdiction, and data breach notification laws are the place to check deadlines and duties for your location.

What you can do as an affected person

Treat a breach notice as a prompt to act, not as a closed matter.

  1. Identify what was exposed. Read the notice for the data types involved. Credentials call for a different response than contact details.
  2. Replace exposed credentials. Change passwords on the affected service and on any account where you reused the password. A Password Managers Explained: Why You Need One And How It Protects Your Digital Life In 2026 – Technopolicy guide shows how a manager makes unique passwords manageable.
  3. Exercise your rights. Use your access right to see what the organisation holds, and an erasure or deletion request if you no longer want the account.
  4. Consider monitoring. If identity theft is a concern, Best Identity Theft Protection Companies in 2026: 7 Top Services Compared And How To Choose – Technopolicy compares paid options. Weigh whether you need one after a breach involving sensitive identifiers.
  5. Watch for follow-on attacks. Breached data often fuels phishing. The Most Common Cybersecurity Attacks: A Practical 2026 Guide To Threats You Need To Know – Technopolicy describes what to look out for.

Encryption and security as part of privacy

Privacy law and security practice meet at the principle that personal data must be processed in a manner that ensures appropriate security. That principle is why encryption appears in both regulation and breach exposure.

Randtronics argues that if you use encryption appropriately you minimise the risk of a data breach in the first instance, and that doing so helps you show legal compliance. That is a vendor’s view, so treat it as a reasoned argument, not a guarantee. It is consistent with the HIPAA Security Rule’s provisions for encryption and robust authentication, and with the CCPA lawsuit provision tied to nonencrypted or nonredacted data.

End-to-end encryption is one way to apply that principle when you communicate. Where a messaging or storage service offers it, switching it on is a low-effort way to meet the standard of appropriate security for your own data. Choose services that describe their encryption clearly, and use strong authentication alongside it.

For business owners, security tooling is part of compliance. A shared password policy is hard to enforce without a manager, and Best Password Manager For Small Business In 2026: Secure, Scalable Picks And How To Choose – Technopolicy covers the options for small teams.

Surveillance, cameras and biometric data

Cameras and biometric tools collect personal data, so the principles in this guide still apply. A system that gathers more than it needs breaches the minimisation principle. A system that stores footage or templates insecurely breaches the integrity and confidentiality principle. Your access and deletion rights are also meaningful here when the law applies to the organisation operating the system.

A row of dark brick runs along the top edge of the wall. Fixed cameras such as these collect personal data continuously, which is why minimisation and secure storage matter for them.

Policy debate around these technologies moves faster than legislation, so use the explanatory guides to understand the trade-offs. Facial Recognition Technology: 7 Real Benefits Transforming Security, Service, And Efficiency In 2026 – Technopolicy sets out the case for the technology. AI Surveillance Technology: What It Is, How It Works, and Why It Matters in 2026 – Technopolicy explains how systems work. AI Surveillance Companies: Who’s Building The Surveillance State In 2026 — Key Players, Risks, And What You Need To Know – Technopolicy looks at the vendors involved. Reading the benefits and the risks side by side gives a fairer basis for deciding whether to object to a particular deployment.

A wooden desk with a desk lamp sits in the blurred background. The lock screen is the first control between a phone’s stored data and anyone else who picks it up.

Consent also matters when conversations are captured. Whether a recording is lawful turns on state rules, and the answer to is it legal to record a phone call should be checked before you record or accept being recorded.

Turning rights into action

A right is only useful if you use it. This sequence works for most requests.

  1. Identify the governing law. If the organisation collects or uses an EU citizen’s data, GDPR can apply even outside Europe. If the service is covered by California law, the CCPA routes apply. Elsewhere in the US, check the state.
  2. Choose the narrowest right that solves the problem. Access to see data, rectification to fix it, erasure or deletion to remove it, opt-out to stop sale or sharing.
  3. Make the request in writing. Keep a copy of what you asked and when, so you can follow up if the reply is incomplete.
  4. Secure the account before and after. Strengthen authentication so that the data you keep is protected.
  5. Escalate where needed. If an organisation ignores a request, use the broader guidance on your online rights to decide your next step.

Limit what you hand over in the first place. The minimisation principle exists because data that is never collected cannot be breached. Decline optional fields, review sharing settings and prefer services that are explicit about why they need data.

A short compliance baseline for organisations

Across GDPR, CCPA and HIPAA, the supported common ground gives a workable baseline.

  • Obtain valid consent where the law demands it. For GDPR, that means clear opt-in consent with a distinguishable process. For CCPA, it means a working opt-out of sale or sharing.
  • Collect only what you need. Tie each data field to a stated purpose.
  • Apply encryption and strong authentication. These controls are named in HIPAA and tied to exposure under CCPA and breach risk generally.
  • Plan for breaches before they happen. Know who reports, to whom and how quickly under each law that applies to you.
  • Assign responsibility. Where GDPR applies, appointing a DPO is a legal requirement.

Small teams should avoid building three separate programmes. Start with the strictest standard that applies to you, then add jurisdiction-specific steps. The checklist in the compliance guide linked earlier suits that approach.

Frequently asked questions

Does GDPR apply to companies outside the EU?

It can. GDPR applies when a non-EU organisation collects or uses an EU citizen’s data, so location alone does not exempt a business.

Does CCPA require opt-in consent like GDPR?

No. CCPA does not require prior consent for collection. It gives consumers a right to opt out of the sale of their data.

Is a data protection officer always required?

Under GDPR, appointing a DPO to oversee data protection strategy and compliance is described as a legal requirement for subject organisations. The description comes from a general data privacy guide, so confirm details for your own organisation.

Is there a single US privacy law?

No. With no single federal privacy law, businesses face a patchwork of state laws, and California’s CCPA as amended by CPRA is described as the most expansive of them.

, , , , , , ,

Related Articles