Law on Personal Data, data subject rights

Art. 7 gives a data subject the right to learn whether their data is held, to request the legal justification for its collection, processing, or third-party transfer and the consequences of that transfer, to access the data's content, to know the processing purpose, retention period, methods, and who has access, to demand correction and, subject to statutory exceptions, destruction or archiving instead, to demand a ban on collection or processing, to learn the data's source and demand proof of lawful collection, to demand protection, and to receive information about a system's conformity certificate or state examination.

Art. 7.2 adds a written, substantiated objection right that requires the controller to immediately stop processing on receipt unless processing is legally mandatory, and Art. 7.3 adds a right to object to a decision produced through information-technology processing that harms the subject's interests, triggering either a consent-seeking obligation or an immediate processing halt. Art. 7.4 separately gives a damages right, recorded in the enforcement instrument.