What Are Information Rights and How Do They Work?

Information rights are the legal powers that let you see, correct, or delete records held about you, and that let you obtain records showing how your government operates. In the United States they come from a patchwork of laws rather than a single statute: the Freedom of Information Act for federal agency records, the Privacy Act of 1974 for your personal file at a federal agency, HIPAA for your medical records, and a growing set of state consumer privacy laws for data held by private companies. The right you can use depends on who holds the record and what kind of record it is.

What You Can Ask a Company for About Yourself

When a private business collects your personal information, state privacy laws give you a defined set of rights over it. The California Consumer Privacy Act was the first comprehensive framework and remains the most prominent. Under the CCPA, California residents can ask a business to disclose the categories and specific pieces of personal information it has collected, where that information came from, and which third parties received it.¹ You can also request deletion of your data and opt out of its sale.

California is no longer alone. As of 2026, roughly 20 states have enacted comprehensive consumer data privacy laws, including Virginia, Colorado, Connecticut, Texas, Oregon, Indiana, Kentucky, and Rhode Island. The specific rights vary, but most let you access your data, correct inaccuracies, request deletion, and opt out of targeted advertising or data sales. Colorado adds a right to data portability, letting you obtain your data in a format you can move to a different company.

If you have any connection to the European Union, the General Data Protection Regulation applies to your data no matter where the company sits. The GDPR covers any business that offers goods or services to people in the EU or monitors their behavior.² It gives you a right to rectification, meaning the company must fix inaccurate data without unreasonable delay,³ and a right to erasure (often called the right to be forgotten) when the data is no longer needed, you withdraw consent, or it was processed unlawfully.

Your Medical Records Under HIPAA

Health information is governed by its own federal rule. Under HIPAA’s Privacy Rule, you have the right to inspect and obtain a copy of your protected health information from any covered entity, which includes hospitals, doctors’ offices, health plans, and pharmacies that transmit health data electronically.⁴ That covers medical records, billing records, insurance enrollment data, and clinical test results.

A covered entity must act on your access request within 30 days and can take one 30-day extension if it notifies you in writing with the reason.⁵ You can also request amendments when information is inaccurate or incomplete. If the provider agrees, it must make the correction and notify anyone who previously received the wrong information. If it refuses, you can file a written statement of disagreement that becomes part of your permanent record.⁴

Providers may charge for copies, but fees must be reasonable and cost-based, limited to the actual labor of copying, supplies, and postage if you request mailing.⁵ Narrow exceptions apply: psychotherapy notes, information compiled for legal proceedings, and certain research laboratory results can be withheld.

Files Federal Agencies Keep on You

The Privacy Act of 1974 governs how federal agencies handle records about individual people. If an agency maintains a “system of records” that retrieves information by your name, Social Security number, or another personal identifier, you have the right to see what is in that file.⁶ You can review the record, bring someone with you, and request a copy.

If you find errors, you can ask the agency to amend the record. The agency must acknowledge your request in writing within 10 working days and then either make the correction or explain why it refuses. If it denies your amendment, you can appeal to the head of the agency, who has 30 working days to decide. Even if the agency ultimately refuses to change the record, you can file a statement of disagreement that must be attached to your file going forward.⁶

Each agency must publish a System of Records Notice in the Federal Register describing what data it collects, why, how it shares the data, and how you access or correct records about yourself.⁷ If you don’t know whether an agency has a file on you, searching the Federal Register for its SORNs will tell you what systems exist.

Records About the Government Itself

The Freedom of Information Act, codified at 5 U.S.C. § 552, is the main tool for records about what your government is doing, as opposed to records about you. It covers federal executive branch agencies and is available to anyone, regardless of citizenship, profession, or reason for asking.⁸ Internal emails, policy memoranda, spending records, research data, and enforcement reports are all fair game unless a specific exemption applies.

State governments have their own equivalents, commonly called Sunshine Laws or open records laws. Details vary, but virtually every state presumes government records are public and places the burden on the agency to justify withholding.

How to File a Request

For federal agencies, the simplest starting point is FOIA.gov, a centralized portal where you can submit requests to any agency subject to FOIA and track their status.⁹ Some agencies also run their own portals. For a private company under a state privacy law, the privacy policy page typically provides a web form or email address for requests.

When electronic filing isn’t available, certified mail with a return receipt creates a verifiable paper trail and fixes the date the agency received the request, which matters because response deadlines run from receipt.

The biggest practical mistake is describing a request too broadly. Asking for “all documents related to” a topic is a reliable way to get your request delayed, returned for clarification, or denied as unduly burdensome. Narrow by naming specific offices, date ranges, document types, or keywords. A request for “emails between the EPA Region 5 Administrator and Acme Chemical Corporation from January through March 2025 regarding wastewater discharge” moves far faster than “all communications about Acme Chemical.”

For personal records requests to private companies, you will usually need to verify your identity so someone else can’t pull your data. That typically means your full legal name, contact information, and a form of government-issued identification.

Deadlines by Law

Federal agencies must decide whether to comply with a FOIA request within 20 working days of receipt. In unusual circumstances the agency can take a written extension of up to 10 additional working days, but it must say why and when to expect a response.⁸ In practice, backlogs at popular agencies like the FBI and Department of Defense can stretch responses out for months or longer. The 20-day clock is more aspiration than reality at some agencies, but it gives you a legal basis to push back.

Under the CCPA and most state privacy laws, businesses generally have 45 days to respond to a consumer data request, with a possible 45-day extension if the business notifies you within the initial window. HIPAA gives health care providers 30 days, with one possible 30-day extension.⁵

FOIA Fees and Fee Waivers

FOIA requests are not always free, and what you pay depends on who you are and why you want the records. Federal agencies sort requesters into four categories:

Commercial use requesters pay for search time, document review, and duplication. No free pages or hours.
Educational or scientific institution requesters pay only for duplication beyond the first 100 pages. No search or review fees.
News media representatives are treated like educational requesters. Freelance journalists qualify if they can show a reasonable expectation of publication.
Everyone else gets the first two hours of search time and the first 100 pages of duplication free, and pays no review fees.¹⁰

If you make a request on behalf of someone else, the fee category depends on that person’s identity and intended use, not yours. Setting a maximum fee cap in your request letter (such as $25 or $50) prevents surprise charges; the agency will contact you before exceeding your limit.

You can also request a complete fee waiver. The standard is that disclosure must be likely to contribute significantly to public understanding of government operations and must not be primarily for your commercial benefit.¹¹ Journalists and researchers regularly receive fee waivers. Someone requesting records to support a private lawsuit typically will not.

When You Need Records Fast

FOIA allows you to request expedited processing in two situations: when a delay could reasonably be expected to pose an imminent threat to someone’s life or physical safety, or when a person primarily engaged in disseminating information has an urgent need to inform the public about government activity.¹² The second category is aimed at journalists covering breaking stories, not researchers on long-term projects.

Your request must include a certified statement that the facts you describe are true and correct. The agency has 10 days to decide. If granted, your request jumps ahead in the queue. If denied, you can appeal administratively or challenge the denial in court.¹²

What Agencies Are Allowed to Withhold

FOIA creates a presumption of openness but carves out nine categories of information agencies may withhold:

Exemption 1 covers classified national security information properly classified under an executive order.
Exemption 2 covers matters related solely to an agency’s internal personnel practices.
Exemption 3 covers information another federal statute specifically prohibits from disclosure.
Exemption 4 covers trade secrets and confidential commercial or financial information obtained from a private party.
Exemption 5 covers inter-agency or intra-agency communications that would be protected by legal privilege in litigation, including drafts, policy discussions, and attorney-client communications. The privilege expires for records 25 or more years old.
Exemption 6 covers personnel, medical, and similar files where disclosure would be a clearly unwarranted invasion of personal privacy.
Exemption 7 covers law enforcement records, but only when release would interfere with enforcement proceedings, deprive someone of a fair trial, invade privacy, reveal confidential sources, expose investigative techniques, or endanger someone’s life.
Exemption 8 covers reports prepared by or for agencies that regulate banks and other financial institutions.
Exemption 9 covers geological and geophysical information about wells.¹²

In practice, Exemptions 5, 6, and 7 are the ones agencies invoke most aggressively, and the ones most often challenged on appeal. When an agency withholds information, it must tell you which exemption applies and release any reasonably segregable non-exempt portions. Expect documents with redacted sections rather than wholesale refusals.

When an Agency Won’t Confirm Records Exist

Occasionally an agency will refuse to even confirm or deny that responsive records exist. This is called a Glomar response. Courts have held agencies may use it only in rare circumstances where merely confirming a record’s existence could itself cause harm falling under one of the exemptions. The agency can’t rely on boilerplate and must provide detailed justification. If the agency has already publicly acknowledged the information, it generally waives its right to a Glomar response.

If Your Request Is Denied

A denial is not the end of the road. Under FOIA, you have at least 90 days from the date of an adverse determination to file an administrative appeal with the head of the agency, and the agency must decide the appeal within 20 working days.⁸ You can also contact the agency’s FOIA Public Liaison or the Office of Government Information Services, a federal FOIA ombudsman that mediates disputes.

If the agency upholds the denial on appeal, you can file suit in federal district court; you must exhaust the administrative appeal first. If you substantially prevail, the judge may award attorney fees, particularly when the agency acted unreasonably or the case served the public interest.

For private-sector denials under state consumer privacy laws, the appeal process varies by state. Several states, including Colorado, give consumers a formal right to appeal a business’s refusal to act on a data request. If the business still denies the appeal, you can file a complaint with the state attorney general’s office, which has enforcement authority over the privacy law.

1
State of California – Department of Justice – Office of the Attorney General. California Consumer Privacy Act
2
General Data Protection Regulation (GDPR). Art 17 GDPR Right to Erasure (Right to Be Forgotten)
3
General Data Protection Regulation (GDPR). Art 16 GDPR Right to Rectification
4
U.S. Department of Health and Human Services. Summary of the HIPAA Privacy Rule
5
eCFR. 45 CFR 164.524
6
Office of the Law Revision Counsel. 5 USC 552a
7
U.S. Department of the Treasury. System of Records Notices (SORNs)
8
Office of the Law Revision Counsel. 5 USC 552 – Public Information; Agency Rules, Opinions, Orders, Records, and Proceedings
9
FOIA.gov. FOIA.gov – Freedom of Information Act
10
eCFR. 14 CFR 1206.507 – Categories of Requesters
11
FOIA.gov. Freedom of Information Act – Frequently Asked Questions
12
Office of the Law Revision Counsel. 5 USC 552 – Public Information; Agency Rules, Opinions, Orders, Records, and Proceedings