What is data ownership?
Definition
Data ownership is the question of who has the right to control a set of data: to decide how it's collected, used, shared and deleted. For personal data, privacy laws usually give people rights over it rather than treating it as property.
- Category
- Privacy
- Also called
- who owns data, data owner
- Last updated
The phrase has two common meanings, and they get mixed up.
Inside a company, a data owner is the person or team accountable for a dataset: they decide who can access it, how it's used and how long it's kept. That's a governance role. Our entry on data owner covers it.
For you as an individual, data ownership asks a different question: when a company holds your name, address and browsing history, what can you do about it?
What the GDPR gives you
The GDPR doesn't describe personal data as something you own. It gives you rights over data about you. The European Data Protection Board lists them: to be informed, to access your data, to have it corrected, to have it erased (the "right to be forgotten"), to restrict processing, to object to certain uses, to move your data (portability) and not to be subject to a decision based only on automated processing.
The right of access in Article 15 is the easiest to use. You can ask a company to confirm whether it's processing personal data about you and to give you a copy.
A concrete example
You ask a retailer for everything it holds on you. You get back your order history, the email address and phone number you gave, and the profile it built from your browsing. You spot an old address and ask for it to be corrected, then ask it to delete the account.
Where this gets practical
Rights only help if you know who holds your data. Most people can't name more than a handful of companies, while data brokers hold profiles of them that they never agreed to. The rights exist; finding the holders is the hard part.
The rules depend on where you live, and this is general information, not legal advice.
How to protect yourself
- 1
Ask for a copy of your data
Send a data subject access request to companies you use. Our guide to the data subject access request explains the steps.
- 2
Ask for deletion when you stop using a service
Close the account and ask in writing for your data to be erased. Keep the confirmation.
- 3
Check which companies have your details
Search your name and email, and look at people-search sites. Serus finds where your data is listed and removes it for you, and keeps watching for it to come back.
- 4
Read what you agree to
Look at what a sign-up says it will do with your data, and decline optional sharing and marketing.
See where your personal data is exposed
Serus finds it on data brokers and people-search sites and removes it.
Frequently asked
Do I own my personal data?
Under the GDPR you hold rights over it (access, correction, erasure and more) rather than a property title. Rules differ by country, so check the law where you live.
Who owns data collected by a company?
Inside a company, a named data owner is accountable for each dataset. Toward you, the company is a controller with duties to respect your rights over personal data it holds about you.
Can I ask a company to delete my data?
In many places you can. The GDPR includes a right to erasure, which applies in certain cases rather than always. Ask in writing and say what you want deleted.
Sources
Something wrong or out of date? Tell us and we'll re-check it.