Data subject rights — the full catalogue
Chapter three of the Law on Personal Data Protection grants the data subject eight rights, each answering a specific practical need: how to learn about processing, how to obtain a copy of your data, how to correct an error, how to stop processing, how to block disputed data, how to move them to another service, how to protect yourself from automated decisions, and how to withdraw consent. Knowing this catalogue is essential both for the subject — who receives instruments — and for the organization, which receives a list of duties.
Information and access
Under Article 13, the subject may request the controller to confirm whether data concerning them are processed and, corresponding to the request, receive free of charge information about the data, the basis and purpose of processing, the source, storage period, rights, transfers and automated decisions. Article 14 governs access and copies: the subject receives copies of the data free of charge — except where a fee is established by legislation or a reasonable fee applies to a different format. Both requests are fulfilled within 10 working days, extendable in exceptional cases by 10 working days with immediate notice.
Rectification and cessation of processing
Under Article 15, the subject may demand correction, updating or completion of inaccurate or incomplete data — within 10 working days of the request; on refusal, the ground is communicated with an explanation of the appeal procedure. Where the controller itself discovers an error, it corrects it within a reasonable period and notifies within 10 working days, also informing recipients of the data. Under Article 16, the subject may demand cessation of processing — profiling included — deletion or destruction of data; refusal is possible only on the grounds listed by law — for instance another processing ground, a legal claim, freedom of expression, archiving, research or statistics — and the controller must justify it. For publicly available data, the subject may additionally demand restriction of availability or deletion of internet links.
Article 17 names five blocking cases: the subject disputes the accuracy of the data; the processing is unlawful but the subject seeks blocking rather than deletion; the data are no longer needed for the purpose but are needed for a complaint; a cessation request is under examination; or the data must be preserved as evidence. Information about the blocking decision is communicated within 3 working days of the request; blocked data may be processed only by storage, except with the subject's consent, for a legal claim, for the protection of interests or in the public-interest cases established by law.