Personal Data Sovereignty Act DataSovereignty Takes Effect in EU: Users Gain Complete Rights to Data Access and Deletion for the First Time
EU DataSovereignty Act goes beyond GDPR, granting users three rights — viewing all entities holding their data, demanding complete deletion, and blocking data transactions — with penalty caps raised to 8% of global revenue.
On February 1, 2029, the EU's Data Sovereignty Act officially took effect. Dubbed "GDPR 2.0," this regulation takes much larger strides in data protection, granting EU citizens three rights that previously did not exist.
The first is "panoramic right to know." Users can view a complete list of all entities holding their personal data through a unified data portal — not just platforms they've registered with, but also data brokers who obtained data through data trading and third-party sharing. Data brokers must register with the EU Data Authority within 6 months of the Act's effective date and disclose data sources.
The second is "comprehensive right to delete." Users can require any entity holding their data to completely delete all copies, including backup system copies. Entities must complete deletion within 30 days and provide auditable deletion certificates. This is stricter than GDPR's deletion right — GDPR allows enterprises to retain data under certain circumstances.
The third is "data transaction prohibition." Users can permanently prohibit their data from being used for commercial transactions. Once activated, no entity may sell or share that user's data with third parties, with violations facing fines up to 8% of global revenue.
Tech industry reactions to the Data Sovereignty Act are mixed. Meta and Google stated they will comply but called for longer compliance transition periods. Small tech companies worry compliance costs may crush innovation.
Disclaimer
Content is AI-generated. Do not use it as a basis for real decisions. Do not cite it as factual reporting.