Your data rights, mapped

Field 01Six rights on one page

The rights are cumulative but not interchangeable. Access and rectification are the everyday ones — see the data, fix the data. Erasure, portability, objection and restriction are the more specific ones, each with a narrower reach. The single most common error is treating erasure as a universal delete: it reaches data whose purpose has ended, and it stops at the legal floors that keep a record alive. The map below is the general model; the law that applies to you depends on where you live and on your account.

• Indigo — rights that reach broadly
• Tangerine — rights with a legal floor or a limit
• Green — rights that end a purpose cleanly

Field 02Access and rectification — see it, then fix it

Access gives you a copy of the personal data held and the details around it — purposes, categories, recipients, retention and source. It is the broadest right, limited mainly by the need to confirm your identity and by redaction of other people’s data. Rectification fixes data that is inaccurate or incomplete: a misspelled name, an out-of-date address, a wrong date of birth. When a correction is made, the operator should also tell the recipients who were given the wrong data, where the law requires it — which is why a rectification request is worth pairing with an access request for the recipient list.

• Access — ask for the copy The data plus the details; no reason needed and usually no fee.
• Rectification — name the field Say exactly what is wrong and what the correct value is.
• Ask who was told A correction should flow to recipients; ask which ones were informed.
• Keep the request The dated request is what establishes the clock and the record.

Field 03Erasure — real, but never absolute

The right to erasure reaches data whose purpose has ended: a marketing profile when you withdraw consent, a completed support thread, a preference flag. It does not reach data a legal duty requires be kept — the identity and transaction records on their multi-year floors, the source-of-funds evidence, or a self-exclusion marker kept so it keeps working. An operator refusing erasure should name the ground; a refusal with no ground is the version to escalate. When erasure is granted for part of a request and refused for another part, read the two grounds separately: a lawful retention sitting beside an unexplained refusal is a signal the unexplained part is the one worth pushing.

Field 04Portability — the data you provided, in a usable format

Portability gives you the personal data you provided, in a structured, commonly used, machine-readable format, and — where technically feasible — a right to have it sent to another controller. Two limits matter. First, it covers provided data on a consent or contract basis, not every internal record. Second, moving to another operator is a weaker proposition than the format suggests, because the second operator must verify you afresh under its own licence and cannot simply inherit the first operator’s verification. For most readers the value is a clean export of your own history.

Field 05Objection and restriction — stop the use, or freeze it

Objection targets processing on legitimate interest or for direct marketing. For marketing it is decisive: the marketing must stop, no balancing test. For other legitimate-interest processing the operator must either stop or show compelling grounds that override your objection. Restriction is different — it freezes the use of data while a dispute about its accuracy or lawfulness is resolved, so the data is stored but not used for anything else. It is the right to reach for when you are challenging a record but do not want it deleted before the challenge is decided.

Field 06The escalation order that actually decides

Every right follows the same route. Ask the operator first, in writing, naming the right and the data, and keep the dated record. If the reply is late, partial or refuses with no ground, ask again for the specific ground. If that fails, complain to the operator’s data-protection contact formally, and then to the data-protection authority in your country, which can investigate and, in many regimes, order a response. A dispute about a bet or a licence is a different track and belongs with the gambling regulator. Time limits and the order can differ by jurisdiction, so check the operator’s own complaint page and its authority’s process.