GDPR Explained for Consumers: What Your Rights Actually Mean

GDPR became law in May 2018 and is now the world's strongest data protection regulation. Here's what it means for you as a consumer.

Your six core rights

**1. Right to access.** You can ask any company what data they hold on you. They must respond within 30 days, for free.

**2. Right to erasure ("right to be forgotten").** You can request deletion of your data. Companies must comply unless they have a legitimate legal basis to keep it.

**3. Right to portability.** You can request your data in a machine-readable format and transfer it to another service.

**4. Right to rectification.** You can correct inaccurate personal data.

**5. Right to restriction.** You can ask a company to stop processing your data while a dispute is resolved.

**6. Right to object.** You can object to processing for direct marketing purposes — and the company must stop immediately.

Why this matters when buying European EU companies are legally bound by GDPR. US companies serving EU customers must also comply, but enforcement is harder. When you buy from a European company with EU data centers, your data never leaves GDPR jurisdiction.

How to exercise your rights Email the company's Data Protection Officer (DPO). Every EU company that processes personal data must have one. The email is usually privacy@[company].com or dpo@[company].com.