Provision record
Dun & Bradstreet · D&B Privacy Policy · View original document ↗

Individual Data Subject Rights Portal

Medium severity Medium confidence Explicitdocumentlanguage Common · 290 of 352 platforms
Stay ahead of the changes
Track Dun & Bradstreet and get the diff the day its terms change.
Share 𝕏 Share in Share 🔒 PDF
Recent governance activity Dun & Bradstreet recorded 3 documented changes in the last 30 days.
Follow Dun & Bradstreet →
Monitor governance changes for Dun & Bradstreet Monitor emails you the same day this changes. The archive stays free.
Follow Dun & Bradstreet →

Get the research letter

Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.

Document Record

What it is

D&B provides a web-based portal where individuals can submit requests to access, correct, or delete their personal data held by D&B entities, covering both personal and professional data.

This analysis describes what Dun & Bradstreet's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology

ConductAtlas Analysis

Why it matters (compliance & governance perspective)

The existence of a rights portal is the primary mechanism through which individuals can discover and control what data D&B holds about them, particularly relevant given D&B's data broker status and the likelihood that many individuals are unaware their data is held.

Interpretive note: The document does not specify response timelines, the scope of data covered across all three registered data broker entities, or the identity verification process, creating uncertainty about the practical effectiveness of the rights mechanism.

Recent Activity

This document changed recently

Medium Jul 14, 2026

The updated privacy policy removed explicit language describing how users can manage cookie preferences and enable chat functionality. Previously, the policy stated that users could click 'Manage Choices' to enable or disable specific cookies including 'Chat' cookies. The revised version no longer includes these detailed preference options in the displayed policy language. The terms now indicate that chat functionality requires accepting 'Chat Cookies,' but the granular control mechanisms previously described have been removed from the public policy disclosure.

View change record →
High Jun 15, 2026

The updated privacy statement removes extensive disclosures about Dun & Bradstreet's data processing practices, ethical commitments, certifications, and individual rights procedures. Previously, the policy described the company's core values, ethical principles, ISO certifications, cross-border privacy frameworks, data broker registrations in multiple states, and how individuals could exercise rights. The revised statement now provides minimal substantive guidance. Under the updated terms, users will find substantially less information about how their data is processed, what protections apply, and how to contact the company regarding their rights.

View change record →

Consumer impact (what this means for users)

Individuals can submit data access, correction, or deletion requests via D&B's TrustArc-hosted portal, which applies to both personal and professional data held by D&B. The practical scope of which rights are available may vary by jurisdiction, as GDPR, CCPA, and other frameworks confer different and not always identical rights.

What you can do

⚠️ These actions may provide transparency or partial mitigation but may not fully address the underlying issue. Effectiveness varies by jurisdiction and individual circumstances.
  • Delete Your Data
    Go to the D&B Individual Rights portal at the TrustArc link. Choose whether you want to access, correct, or delete your data. Complete the form and submit. D&B is obligated under applicable law to respond within the statutory timeframe for your jurisdiction.

How other platforms handle this

Roblox Medium

Further, you may take legal actions in relation to any potential breach of your rights regarding the processing of your Personal Information, as well as to lodge complaints before the competent data prot...

ZipRecruiter Medium

Where ZipRecruiter processes your Personal Data in the capacity of a service provider (data processor), and you seek access, or want to correct, amend, or delete your Personal Data...we will provide you with the data controller's contact information, so you can contact them directly.

Square Medium

to request that your data be transferred to a third party (data portability)

See all platforms with this clause type →

Monitoring

Dun & Bradstreet has changed this document before.

Receive same-day alerts, structured change summaries, and monitoring for up to 20 platforms.

Follow Dun & Bradstreet → Or get the research letter, free →
▸ View Original Clause Language DOCUMENT RECORD
"
We are committed to respecting the data and digital rights of individuals in both their personal and professional capacities as set forth in our Global Data Subject Rights Policy Statement. You may exercise your rights in connection with our data processing here.

Excerpt from Dun & Bradstreet's D&B Privacy Policy

ConductAtlas Analysis

Institutional analysis (regulatory & governance intelligence)

REGULATORY LANDSCAPE: The data subject rights framework engages GDPR Articles 15-22 (rights of access, rectification, erasure, restriction, portability, and objection), CCPA/CPRA rights to know, delete, and correct, and equivalent rights under the UK GDPR, Swiss FADP, and other applicable national laws. The TrustArc platform as the operational mechanism for rights fulfillment means D&B has engaged a third-party consent and rights management processor, which itself introduces a sub-processor relationship subject to data processing agreement requirements. GOVERNANCE EXPOSURE: Medium. The rights portal commitment is positive from a transparency standpoint, but the adequacy of response timelines, identity verification processes, and the scope of data covered (across all three registered data broker entities) is not detailed in this document. GDPR requires responses within 30 days; CCPA requires responses within 45 days with a possible 45-day extension. JURISDICTION FLAGS: EU and UK data subjects have the strongest enforceable rights framework, including the right to object to processing on legitimate interests grounds and the right to lodge complaints with supervisory authorities. California residents have CCPA/CPRA rights that may be more operationally straightforward to enforce. Rights available to individuals in jurisdictions without comprehensive privacy laws (e.g., most U.S. states outside California, Colorado, Virginia, Texas) depend on D&B's voluntary commitments under this statement. CONTRACT AND VENDOR IMPLICATIONS: Organizations that have provided D&B with employee or customer data through data licensing or API integrations should assess whether their vendor agreements with D&B address downstream data subject rights fulfillment obligations, including who is responsible for responding to deletion requests that flow through the organization's own privacy mechanisms. COMPLIANCE CONSIDERATIONS: Compliance teams should verify that D&B's TrustArc sub-processor arrangement is covered under an appropriate data processing agreement and that D&B's response to rights requests includes data held by Eyeota and NetWise entities. Teams should also confirm whether the portal's geographic scope covers all jurisdictions in which their employees or customers may be located.

Stay ahead of the changes

Full institutional analysis

Regulatory citations, enforcement risk, and due diligence action items.

Applicable agencies

  • FTC
    The FTC oversees consumer protection and data rights practices for U.S.-based data brokers and can receive complaints regarding failure to honor data subject rights requests.
    File a complaint →

Applicable regulations

CCPA/CPRA
California, USA
Connecticut Data Privacy Act Amendments
US-CT
FTC Act Section 5
United States Federal
GDPR
European Union
Indiana Consumer Data Protection Act
US-IN
Kentucky Consumer Data Protection Act
US-KY
Universal Opt-Out Mechanism Expansion 2026
US

Provision details

Document information
Document
D&B Privacy Policy
Entity
Dun & Bradstreet
Document last updated
May 5, 2026
Tracking information
First tracked
May 7, 2026
Last verified
May 10, 2026
Record ID
CA-P-007989
Document ID
CA-D-00722
Evidence Provenance
Source URL
Wayback Machine
Content hash (SHA-256)
d8b56bc5d2b8bea4b35bf727a3c9d12d285801ea1c487d138b87ed807ca66d3d
Analysis generated
May 7, 2026 15:50 UTC
Methodology
Evidence
✓ Snapshot stored   ✓ Hash verified
Citation Record
Entity: Dun & Bradstreet
Document: D&B Privacy Policy
Record ID: CA-P-007989
Captured: 2026-05-07 15:50:32 UTC
SHA-256: d8b56bc5d2b8bea4…
URL: https://conductatlas.com/platform/dun-bradstreet/db-privacy-policy/provision/CA-P-007989/individual-data-subject-rights-portal/
Accessed: July 28, 2026
Permanent archival reference. Stable identifier suitable for legal filings, compliance documentation, and research citation.
Classification
Severity
Medium
Categories

Other risks in this policy

Related Analysis

Stay ahead of the changes

Governance intelligence across arbitration, AI governance, data rights, indemnification, and retention

Provision-level monitoring, governance timelines, and regulatory mapping built from archived source documents and historical version tracking.

Frequently Asked Questions

What does Dun & Bradstreet's Individual Data Subject Rights Portal clause do?

The existence of a rights portal is the primary mechanism through which individuals can discover and control what data D&B holds about them, particularly relevant given D&B's data broker status and the likelihood that many individuals are unaware their data is held.

How does this clause affect you?

Individuals can submit data access, correction, or deletion requests via D&B's TrustArc-hosted portal, which applies to both personal and professional data held by D&B. The practical scope of which rights are available may vary by jurisdiction, as GDPR, CCPA, and other frameworks confer different and not always identical rights.

How many platforms have this type of clause?

ConductAtlas has identified this type of provision across 290 platforms. See the full comparison.

Is ConductAtlas affiliated with Dun & Bradstreet?

No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Dun & Bradstreet.