How do I find out what data a company has on me?

Question

Accepted Answer

Send a written access request; most US state privacy laws and the GDPR make it a right. In California it is the right to know (Civ. Code § 1798.110(a)): the categories of personal information collected, the sources, the business purpose, the categories of third parties it was disclosed to, and the specific pieces held about you. The business must respond within 45 days, may extend once by 45 days if it tells you why, must deliver the data free in a readable and machine-readable format, and you may ask twice in any 12-month period (§ 1798.130(a)(2), (b)). The default window is the past 12 months, but you can demand everything collected since January 1, 2022. It must not send you your Social Security number, ID numbers, passwords or financial account numbers, only confirm that it holds them (regs § 7024(d)). Virginia and Connecticut use the same 45-day clock, free up to twice a year in Virginia, with a 60-day appeal answer and a route to the attorney general (Va. Code § 59.1-577). Under the GDPR you get a free copy within one month, extendable by two (Arts. 12(3), 15). Use the method named in the privacy policy and keep the date. Build the request at https://takeitdown.agentexchange.work/request/privacy (free; you send it, the deadline is tracked).

How do I find out what data a company has on me?

Related