Revocation

A data subject must be allowed to request access to the PI an entity has collected from or holds on their behalf and should be able to revoke their continued permission for the entity's collection, creation, use, processing and retention of a data subject's PI. An entity that seeks to transfer processing and control of a data subject's PI to another legal entity or person remains responsible for notifying affected data subjects of the other processor and controller's roles and for allowing a data subject to revoke their permission to continue to use and hold the data subject's PI.