Privacy laws, explained
PIPEDA, Quebec’s Law 25, the CCPA/CPRA and the GDPR in plain words: what they let you ask for and how long companies have to answer.
This is a plain-language overview, not legal advice. Frame uses the law where you live, which you set in Settings → Profile.
Canada: PIPEDA
PIPEDA covers private companies across most of Canada. You can ask a company what it holds about you, have it corrected, and withdraw your consent. Companies generally have 30 days to answer an access request. The Office of the Privacy Commissioner of Canada takes complaints.
Quebec: Law 25
Quebec’s private-sector privacy law, updated by Law 25, gives you rights to access, correct and stop the spread of your information. Companies have 30 days to answer. The Commission d’accès à l’information handles complaints.
California: CCPA/CPRA
You can ask a business to tell you what it holds, delete it, correct it, and stop selling or sharing it. Businesses have 45 days to answer. Data brokers must register with the state, which is what makes DROP possible. The California Privacy Protection Agency enforces it.
Europe and the UK: GDPR
The GDPR and the UK GDPR include a right to erasure. Companies have one month to answer, which they can extend in some cases. In the UK, the Information Commissioner’s Office takes complaints.
Elsewhere
Other places have their own laws. If yours isn’t listed, you can still use Frame’s guides: most brokers accept opt-outs from anyone.
Was this guide helpful?
Your answer isn’t stored or sent anywhere.
Still stuck? Contact us or check system status.