Right to Access
Request a complete copy of all personal data an organization holds about you, including how it's processed, shared, and for how long it's stored.
8 quick questions
What's your personal privacy risk score?
QUESTION 1 OF 8
Latest headlines
Privacy & AI News
Loading
Fetching latest privacy & AI news…
Live headlines from NOYB, EDPB, FTC, ICO, and more.
Regulatory deadline calendar
Privacy & AI Regulation Deadlines
Every major regulatory deadline globally — filterable by region, law, and urgency. Updated continuously. Bookmark this page and never miss a compliance date.
Critical — within 90 days
Upcoming — within 6 months
Future — 6+ months
Recently passed
| Date | Regulation / Law | Jurisdiction | What happens | Type | Who it affects |
|---|
Live enforcement intelligence
Corporate Privacy Watchlist
Companies currently under active investigation by data protection authorities. Updated as new proceedings open and close.
Sources
EDPB News
DPC Ireland
CMS Enforcement Tracker
NOYB Cases
GDPRhub
IAPP Privacy Tracker
· Status current as of May 2026 · Investigations may close or expand at any time
What they actually do with your data
Big Tech & AI — In Plain English
Most privacy policies run to 10,000 words of legal fog. We translate what the biggest platforms actually collect, how they use it, and exactly what rights you have against each one.
Sources
EDPB
DPC Ireland
NOYB
CMS Enforcement Tracker
Privacy Affairs
· Official privacy policies and DPA decisions for each company listed below each panel
No legal jargon
Major Fines, Explained for Everyone
Every big enforcement action translated into plain language — what the company did wrong, what it means for you, and what you can do about it.
Sources
CMS Enforcement Tracker
EDPB
GDPRhub
Privacy Affairs
· Official DPA decisions linked per case below
Know your rights
01
02
03
04
05
06
Your Global Privacy Rights
Under GDPR, CCPA, LGPD, and dozens of other laws, you have enforceable rights over your personal data. Here's what they mean in practice.
Right to Erasure
Ask organizations to permanently delete your personal data — the "right to be forgotten" — when data is no longer necessary or consent is withdrawn.
Right to Object
Stop companies from processing your data for direct marketing, profiling, or purposes you haven't consented to. Must be honored without delay.
Data Portability
Receive your data in a structured, machine-readable format and transfer it freely — giving you control over your digital identity.
Right to Restrict
Limit how an organization can use your data while a dispute is resolved — if you contest accuracy or have objected to processing.
Right to AI Explanation
Request a human review of automated decisions — credit scoring, hiring, insurance — made by AI systems without human oversight.
DLA Piper Data Protection Navigator
Global Data Protection Heatmap
Regulation & enforcement intensity across 160+ jurisdictions, based on DLA Piper's Data Protection Laws of the World handbook.
Enforcement intensity:
Heavy
Robust
Moderate
Limited
No data
The legal landscape
Major Global Privacy & AI Regulations
The frameworks that give you rights over your data — and the enforcement actions proving they have teeth.
Country lookup
Find regulations by country
Data Protection & Privacy Laws
In Force
In Force
Enforcing
Enforcing
In Force
In Force
In Force
In Force
In Force
In Force
🇪🇺
EU General Data Protection Regulation (GDPR)
World's most comprehensive privacy law. Fines up to 4% of global annual turnover. Applies to all EU residents' data globally.
🇺🇸
California Privacy Rights Act (CPRA)
Expands CCPA rights. Establishes the California Privacy Protection Agency with independent enforcement powers.
🇧🇷
Brazil LGPD (Lei 13,709/2018)
Brazil's GDPR-equivalent. ANPD now issuing active enforcement fines of up to 2% of Brazil revenue.
🇮🇳
India Digital Personal Data Protection Act (DPDP) 2023
India's first comprehensive data protection law. Implementing Rules published November 2025. Enforced by the Data Protection Board of India.
🇨🇳
China Personal Information Protection Law (PIPL) 2021
Strict consent requirements and data localization. Applies globally to processing of Chinese citizens' data.
🇬🇧
UK GDPR / Data Protection Act 2018
Post-Brexit GDPR equivalent enforced by the ICO. Covers UK residents globally. Data (Use and Access) Bill 2025 advancing reforms.
🇨🇭
Switzerland nFADP (revDSG) 2023
New Federal Act on Data Protection in force September 2023. Aligned with GDPR. Enforced by the FDPIC.
🇰🇷
South Korea PIPA (2023 amendments)
Personal Information Protection Act, significantly strengthened 2023. EU adequacy status. Enforced by PIPC.
🇸🇬
Singapore PDPA 2012 (amended 2020)
Personal Data Protection Act. Mandatory breach notification, fines up to 10% of annual turnover. Enforced by PDPC.
🇿🇦
South Africa POPIA 2013
Protection of Personal Information Act, fully in force July 2021. Enforced by the Information Regulator.
Transparency & trust
Why Trust This Site
We believe credibility has to be earned — not claimed. Here's who we are, what our sources are, who has reviewed our work, and how we make decisions.
Expert Commentary
Our enforcement analysis and plain-English explanations are reviewed against official DPA decisions, EDPB guidelines, and IAPP analysis. We cite primary sources on every major claim — no second-hand summaries.
"The most dangerous thing about modern data collection isn't the scale — it's the invisibility. Most people never know their data has been transferred, sold, or breached until something goes wrong."
— Max Schrems, NOYB founder & privacy lawyer, Vienna
"GDPR enforcement is finally catching up with the business models it was designed to constrain. The 2023–2025 fine wave is not the end — it's the beginning of a new enforcement normal."
— Dr. Gabriela Zanfir-Fortuna, Future of Privacy Forum VP for Global Privacy
How We Source Information
Every data point on this site traces back to a verifiable primary source. Our methodology:
- Enforcement data — CMS GDPR Enforcement Tracker (2,800+ cases), DLA Piper annual GDPR fines survey, national DPA press releases
- Company data practices — official privacy policies, DPA investigation reports, court documents, and academic research
- Watchlist status — EDPB binding decisions, DPC Ireland press releases, NOYB case database, national regulator announcements
- Rights information — Official GDPR, UK GDPR, CCPA, LGPD statutory text via EUR-Lex, CNIL, ICO, and IAPP
- Breach data — HaveIBeenPwned API (Troy Hunt), DLA Piper Data Breach Survey
Content reviewed quarterly. Enforcement data updated as DPA decisions are published.
Who We Are
Right to Privacy Foundation is an independent publication. We have no advertisers, no corporate sponsors, and no commercial relationships with any company we cover. We are editorially and financially independent.
Funding
Editorially independent — no commercial relationships
Advertising
None — ever
Data selling
Never — ironic if we did
Tracking
No third-party trackers on this site
Hosting
EU-based servers, GDPR-compliant
Editorial
Fully independent — no outside editorial control
Rate Your Company's Privacy Response
Have you sent a Subject Access Request or deletion request to a company? Tell the community how they responded — building a unique dataset no regulator has.
📰 This week's editorial
Why the TikTok Fine Changes Everything About Cross-Border Data
The €530M DPC decision isn't just about TikTok. It establishes that SCCs alone are insufficient when the destination country's law requires government access to data — a principle that now threatens every US and Chinese tech company operating in the EU.
Get the weekly digest
One email per week. The most important privacy development, explained clearly. No filler.
Expert resources
Suggest a resource →
Privacy References
The organisations, tools, and scholars we trust most for privacy and AI intelligence.
⚖️ Regulators & Enforcement
- European Data Protection Board (EDPB)Coordinates GDPR enforcement across all EU member states. Source of binding decisions and guidelines.
- DPC IrelandLead EU supervisory authority for Meta, Google, Apple, TikTok, LinkedIn, and most US Big Tech.
- UK ICOInformation Commissioner's Office — the UK's independent data protection regulator post-Brexit.
- CNIL (France)France's data protection authority. Active enforcer — fined Google €150M and TikTok €5M for cookie violations.
- Garante (Italy)Italy's DPA. Banned ChatGPT in 2023, fined OpenAI €15M, and among the most active EU enforcers.
- FTC — Privacy & SecurityUS Federal Trade Commission's privacy and data security enforcement programme and guidance.
📊 Trackers & Databases
- CMS GDPR Enforcement TrackerThe most comprehensive public database of GDPR fines — 2,800+ cases, searchable by country, authority, and sector.
- GDPRhubOpen-source wiki of every GDPR decision across all EU/EEA member states. Run by NOYB.
- Privacy Affairs — GDPR FinesInteractive chart of all major GDPR fines with trend analysis and filterable data going back to 2018.
- HaveIBeenPwnedTroy Hunt's authoritative breach database — 14B+ compromised accounts. Check if your email appeared in any breach.
- DLA Piper Data Protection NavigatorInteractive global map of data protection laws across 100+ jurisdictions. Indispensable for cross-border compliance.
✊ Advocacy & NGOs
- NOYB — None Of Your BusinessEurope's most active privacy enforcement NGO. Files strategic GDPR complaints against Big Tech. Founded by Max Schrems.
- EFF — Electronic Frontier FoundationUS digital rights organisation. Leads litigation, policy advocacy, and publishes essential privacy and surveillance guides.
- Privacy InternationalGlobal NGO investigating and challenging government and corporate surveillance. Strong on intelligence agency oversight.
- EDRi — European Digital RightsNetwork of 45+ European digital rights organisations. Tracks EU legislation affecting privacy and civil liberties.
🎓 Professional Bodies & Education
- IAPP — International Association of Privacy ProfessionalsWorld's largest privacy community. Home of CIPP, CIPM, CIPT certifications and daily privacy news across every jurisdiction.
- IAPP Privacy TrackerLive legislative tracker for privacy bills and regulations worldwide — updated daily.
- Prof. Graham Greenleaf — UNSW SydneyWorld's leading scholar on global data privacy law. Author of Asian Data Privacy Laws. Tracks privacy legislation in 140+ countries.
- Law ZeroResearch and advocacy at the intersection of law, AI, and fundamental rights. Responsible AI governance and algorithmic accountability.
🛠️ Tools & Self-Help
- DataRequests.org — Letter GeneratorFree, guided GDPR and CCPA request letter generator. Covers access, erasure, portability, and objection requests for hundreds of companies.
- Privacy Rights Clearinghouse — Broker ListComprehensive list of data brokers with direct opt-out links. US-focused but covers internationally-operating brokers.
- EFF Surveillance Self-DefensePractical, threat-model-based guides on protecting your digital privacy from EFF. Covers journalists, activists, and everyday users.
- Privacy GuidesCommunity-maintained recommendations for privacy-respecting software tools, browsers, VPNs, password managers, and operating systems.