Data subject rights — the full catalogue
Chapter three of the Law on Personal Data Protection grants the data subject eight rights, each answering a specific practical need: how to learn about processing, how to obtain a copy of your data, how to correct an error, how to stop processing, how to block disputed data, how to move them to another service, how to protect yourself from automated decisions, and how to withdraw consent. Knowing this catalogue is essential both for the subject — who receives instruments — and for the organization, which receives a list of duties.
Information and access
Under Article 13, the subject may request the controller to confirm whether data concerning them are processed and, corresponding to the request, receive free of charge information about the data, the basis and purpose of processing, the source, storage period, rights, transfers and automated decisions. Article 14 governs access and copies: the subject receives copies of the data free of charge — except where a fee is established by legislation or a reasonable fee applies to a different format. Both requests are fulfilled within 10 working days, extendable in exceptional cases by 10 working days with immediate notice.
Rectification and cessation of processing
Under Article 15, the subject may demand correction, updating or completion of inaccurate or incomplete data — within 10 working days of the request; on refusal, the ground is communicated with an explanation of the appeal procedure. Where the controller itself discovers an error, it corrects it within a reasonable period and notifies within 10 working days, also informing recipients of the data. Under Article 16, the subject may demand cessation of processing — profiling included — deletion or destruction of data; refusal is possible only on the grounds listed by law — for instance another processing ground, a legal claim, freedom of expression, archiving, research or statistics — and the controller must justify it. For publicly available data, the subject may additionally demand restriction of availability or deletion of internet links.
Article 17 names five blocking cases: the subject disputes the accuracy of the data; the processing is unlawful but the subject seeks blocking rather than deletion; the data are no longer needed for the purpose but are needed for a complaint; a cessation request is under examination; or the data must be preserved as evidence. Information about the blocking decision is communicated within 3 working days of the request; blocked data may be processed only by storage, except with the subject's consent, for a legal claim, for the protection of interests or in the public-interest cases established by law.
How an organization builds on these rights
Knowing the catalogue is not enough — an organization must build a procedure for each right. The first step is defining the intake channel: where and how a subject can submit a request and who is responsible internally. The second is deadline management: each right carries a basic period of 10 working days with a possibility of a 10-working-day extension in exceptional cases, while blocking information is issued within the shorter period of 3 working days. The third is the form of the answer: information is provided in the same form in which the request was made, unless the subject asks otherwise. And the fourth is substantiating refusals: every refusal requires a written ground, and the burden of proof lies on the controller. Organizations that build these processes in advance later avoid disputes and fines.
Portability, automated decisions and withdrawal of consent
Article 18 governs portability: in automated processing based on consent or a contract, the subject receives the data provided by them in a structured, commonly used and machine-readable format or requests their transmission to another controller where technically possible. Article 19 concerns automated decisions: the subject may not be subjected to a decision based solely on automated processing — profiling included — with significant effects, except with explicit consent, for a contract, or by law; on request, human involvement, expression of views and appeal must be ensured. Article 20 is the right to withdraw consent: at any time, without explanation; processing then stops or the data are deleted within 10 working days unless another ground exists. Violating these rights also entails administrative fines — covered on a separate page.
Frequently Asked Questions
Below we answer the questions most frequently asked about privacy rights.
Within what period does the controller answer a request?
The basic period is 10 working days; in exceptional cases it is extended by another 10 working days with immediate notice, while information about blocking is issued within the shorter period of 3 working days.
Are copies of the data issued free of charge?
Yes — except a statutory fee or a reasonable fee for a different format; the fee may not exceed the resource actually expended, and proving its reasonableness lies on the controller.
May a decision about me be made solely automatically?
No — a decision with significant effects may not be based solely on automated processing, profiling included, save with explicit consent, for a contract or as provided by law; on request, human involvement, the expression of a view and the possibility of appeal must be ensured.
How do I exercise the right to portability?
In automated processing based on consent or a contract, you receive the data you provided in a structured, commonly used and machine-readable format, or request their transmission to another controller where this is technically possible.
How We Help on Legal.ge
The Legal.ge team assists both in exercising the rights of a data subject — drafting requests, monitoring deadlines and appealing refusals — and in organizations turning these rights into answers: an intake channel, deadline management and a substantiation procedure for refusals.
If a request has remained unsatisfied or you want to build the privacy processes properly, write to us on Legal.ge.