Under GDPR, users have the right to access and delete their personal data. Businesses must ensure that users can easily access their data and request its deletion if necessary to comply with GDPR regulations.