Ley 25.326, rights of data subjects

Ley 25.326, arts. 6, 13-17, 19-20, 27.3 (data subject rights)

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force since 30 October 2000.

A data subject rights rule binding public and private bodies.

As of 19 September 2026.

What it requires

Before collecting a data subject's personal data, tell them in clear, express terms the purpose it will be processed for and who may receive it, that a file or database exists together with its controller's identity and address, whether answering is mandatory or optional, the consequences of answering, refusing, or answering inaccurately, and that they may exercise access, rectification, and erasure rights.
Let a data subject query the control body's public, free registry to learn what personal-data files exist, their purposes, and their controllers' identity.
On a verified-identity request, give the data subject their personal data from a public or private reporting database within ten running days, free of charge at intervals no shorter than six months absent a legitimate interest, in clear language without codes, covering the whole record without revealing a third party's data, in the medium the data subject chooses.
Rectify, update, or, where appropriate, delete or restrict a data subject's inaccurate, incomplete, or outdated personal data within five business days of the claim or of learning of the error, and notify any recipient the data were disclosed to within five business days, unless erasure would harm a third party's legitimate rights or a legal duty requires retention.
Provide rectification, updating, or erasure of inaccurate or incomplete personal data free of charge, and mark a record as under review while you verify its accuracy.
As a public-sector database controller, deny access, rectification, or erasure only by a reasoned decision grounded in national defense, public order and security, or a third party's rights, or where it would obstruct an ongoing tax, welfare, health, environmental, or criminal-law inquiry, notify the affected person of the refusal with reasons, and still give access where the person needs it to exercise a legal defense.
Do not base a court decision or administrative act evaluating a person's conduct solely on the result of automated processing that profiles their character or personality; treat an act that does so as void.
Let a data subject request the removal or blocking of their name from an advertising, direct-marketing, or profiling database at any time.

What it reaches

Obligation class

Data subject rights, Disclosure

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Article 6 requires telling a data subject, before their personal data is collected, the purpose for which it will be processed and the recipients or classes of recipients, that a file, registry, or database exists together with its controller's identity and address, whether answering the questionnaire is mandatory or optional, the consequences of providing the data, refusing to, or giving inaccurate data, and that they may exercise access, rectification, and erasure rights.

Article 13 lets any person query the control body's public, free registry to learn what personal-data files exist, their purposes, and their controllers' identity.

Article 14 gives the data subject, once their identity is verified, the right to request and obtain their personal data from a public or private reporting database, to be answered within ten running days, exercisable free of charge at intervals no shorter than six months absent a legitimate interest, and exercisable by a deceased person's universal successors.

Article 15 requires the information to be given clearly, without codes, in plain language, covering the subject's whole record without revealing a third party's data, in the medium of the data subject's choice.

Article 16 gives a data subject the right to have their inaccurate, incomplete, or outdated personal data rectified, updated, or, where appropriate, deleted or made confidential, requires the controller to act within five business days of the claim or of learning of the error, requires notifying any recipient the data were disclosed to within five business days, bars erasure where it would harm a third party's legitimate rights or a legal duty requires retention, and requires marking a record under review while its accuracy is verified.

Article 17 lets a public database's controller deny access, rectification, or erasure by a reasoned decision grounded in national defense, public order and security, or a third party's rights, or where disclosure would obstruct an ongoing tax, welfare, health, environmental, or criminal-law inquiry, subject to notifying the affected person with reasons and still giving access when the person needs it to exercise a legal defense.

Article 19 makes rectification, updating, or erasure of inaccurate or incomplete personal data free of charge. Article 20 bars basing a court decision or administrative act that evaluates a person's conduct solely on the result of automated processing that profiles their character or personality, and voids an act that does so. Article 27.3 lets a data subject request the removal or blocking of their name from an advertising, direct-marketing, or profiling database at any time.

When LexLint raises it

crawls_web
trains_models
automated_outreach
high_risk_decisions

Read the law

Official consolidated text of Ley 25.326, InfoLEG (Ministerio de Justicia y Derechos Humanos)

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app