Law No. 124/2024, rights of the data subject

Law No. 124/2024, Arts. 12-21 (rights of the data subject)

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force since 31 January 2025.

A data subject rights rule binding public and private bodies.

As of 19 September 2026.

What it requires

Tell a data subject, in concise and plain language and with particular care where the information is addressed to a minor, your identity and contact details, the purposes and legal basis of processing, the recipients, any transfer abroad, the retention period, and the rights available to them.
Answer a data subject's request under Articles 13 to 20 as soon as possible and no later than 30 days after receiving it, extendable to 60 days for complex or numerous requests, and free of charge unless the request is manifestly unfounded or excessive.
Give a data subject access to their personal data, its purpose, retention period, source, and recipients within 30 days of the request, and correct or erase inaccurate, unlawfully processed, or no longer necessary personal data within 30 days, telling every recipient the data were disclosed to of the change.
Provide a data subject their personal data in a structured, commonly used, machine readable format on request, and transmit it directly to another controller where technically feasible.
Stop processing a data subject's personal data for direct marketing, including related profiling, as soon as they object, without requiring a reason, and tell them of this right explicitly and separately at the first communication.
Give a data subject the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal or similarly serious effects, unless a listed exception applies, and where an exception does apply, let them obtain human intervention, express their view, and contest the decision.

What it reaches

Obligation class

Data subject rights, Disclosure, Access restriction

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Article 13 requires the controller to tell a data subject its identity and contact details, the purposes and legal basis of processing, the recipients, any transfer abroad, the retention period, and the rights available, and Article 12 requires that information to be concise, transparent, and in plain language, with particular care for information addressed to a minor.

Article 12(4) requires the controller to act on a data subject's request as soon as possible and no later than 30 days after receipt, extendable to 60 days for complex or numerous requests, and Article 12(5) makes that response free of charge unless the request is manifestly unfounded or excessive. Article 14 gives a data subject the right to access their personal data, its purpose, retention period, source, and recipients within 30 days of the request.

Article 15 gives a right to rectification of inaccurate data and to erasure on the listed grounds, both within 30 days, and requires the controller to inform every recipient the data were disclosed to of the change. Article 16 gives a right to be forgotten against search engines that continue to surface outdated and reputationally damaging results.

Article 17 gives a right to restrict processing, and Article 18 gives a right to receive personal data in a structured, commonly used, machine readable format and to have it transmitted directly to another controller where technically feasible. Article 19 gives a right to object to processing based on a public task or legitimate interest, and an unqualified right to object to direct marketing and its related profiling at any time without giving a reason.

Article 20 gives a data subject the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal or similarly serious effects, subject to listed exceptions under which the data subject may still obtain human intervention, express their view, and contest the decision.

When LexLint raises it

crawls_web
trains_models
generates_content
deploys_chatbot
automated_outreach
high_risk_decisions

Read the law

Official statute PDF hosted by the Commissioner for the Right to Information and Personal Data Protection (idp.al)
read in full (169,825 characters, untruncated)

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app