Law No. 81/2018, Part V, notice, objection, access and correction

Law No. 81/2018, Arts. 86, 88, 89, 92, 99 to 101, 103, 105 and 32 (notice, objection, access and correction)

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force since 31 March 2019.

A data subject rights rule binding public and private bodies.

As of 19 September 2026.

What it requires

Tell the people you collect personal data from who you are or who your representative is, what the processing is for, whether answering is mandatory or optional, what follows from not answering, who the data will be sent to, and that they may access and correct it, and print that statement explicitly and clearly on the collection form itself.
Where you did not collect the data from the person, tell them personally and explicitly what the data contains, what the processing is for and that they may object to it, unless they already know or telling them is impossible or takes an effort out of proportion to the benefit.
Let a person object, for legitimate reasons, to the collection and processing of their personal data, including processing for commercial promotion, unless the law obliges you to collect it or they have already agreed to the processing.
Let a person review and object to the information and analyses used in automated processing about them, and never let a judicial or administrative decision that assesses human behavior rest solely on automated processing aimed at identifying their qualities or assessing aspects of their personality.
Answer a person's or their heir's question about whether their data is being processed, and give them a copy of the data at their request, in an understandable form where it is encoded, compressed or encrypted.
Give, on the same request, the purposes, categories, source, subject and nature of the processing, the persons and categories of persons the data is sent to or who can access it, and the timing and purposes of that access.
Charge no more than the cost of copying for that copy, and, if you refuse a request as arbitrary, repetitive or systematic, be ready to carry the burden of proving that it is.
Correct, complete, update or erase personal data that is incorrect, incomplete, ambiguous, expired or incompatible with the purposes of processing, free of charge and within ten days of the request, and prove that you did it.
Notify every third party the data was sent to of an amendment made at the request of its owner or their heirs, and make the same correction on your own initiative as soon as you learn of a reason to modify or cancel the data.
Do not inform a person of processing that relates to the internal or external security of the State where informing them may endanger the objectives of the processing or that security.
Mark an online promotional advertisement as a promotional advertisement and name the person it was placed for, send no unsolicited marketing email to a real person's name and address without their consent unless you obtained the address lawfully through a previous engagement with them, and put in every marketing email a reply address through which the recipient can ask to stop receiving them permanently and free of charge.
Expect Articles 99, 100 and 101 not to reach processing carried out solely for literary or artistic expression or for the professional exercise of journalism, within the limits of the laws in force.

What it reaches

Obligation class

Data subject rights, Disclosure, Consent, Access restriction

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Article 88 requires the processing officer or their representative to tell the people the data is taken from who the officer or representative is, what the processing is for, whether answering the questions is mandatory or optional, what follows from not answering, who the data will be sent to, and that they may access and correct it, and requires the collection form itself to carry that statement explicitly and clearly.

Article 89 extends the duty to data not collected from the person concerned, who must be told personally and explicitly what the data contains, what the processing is for and that they may object to it, unless they already know or telling them is impossible or would take an effort out of proportion to the benefit.

Article 92 gives every natural person the right to object, for legitimate reasons, to the collection and processing of their personal data, including collection and processing for the purpose of commercial promotion, except where the law obliges the officer to collect it or the person has agreed to the processing.

Article 86 gives everyone the right to review and object, before the processing officer, to the information and analyses used in automated processing relied on about them, and bars any judicial or administrative decision requiring an assessment of human behavior from resting solely on automated processing aimed at identifying a person's qualities or assessing aspects of their personality.

Articles 99 to 101 carry the access and correction rights: the owner of the data or any of their heirs may ask whether their data is being processed and receive a copy of it, in an understandable form where it is encoded, compressed or encrypted, together with the purposes, categories, source, subject and nature of the processing and the identity of everyone the data is sent to or who can access it and when; the officer may charge no more than the cost of copying and may refuse only requests of an arbitrary, repetitive or systematic nature, carrying the burden of proving that character; and the officer must correct, complete, update or erase data that is incorrect, incomplete, ambiguous, expired or incompatible with the purposes of processing, free of charge and within ten days of the request, prove the work was done, notify any third party the data was sent to, and make the same correction on their own initiative once they learn of a reason for it.

Article 103 withholds that information where the processing relates to the internal or external security of the State and informing the person would endanger it, and Article 105 lifts Articles 99 to 101 from processing carried out solely for literary or artistic expression or for the professional exercise of journalism.

Article 32, in the electronic-commerce part of the same law, requires an online promotional advertisement to say that it is one and to name the person it was placed for, forbids unsolicited marketing email to a real person's name and address without that person's consent unless the address was lawfully obtained through a previous engagement with them, and requires every marketing email to carry a reply address through which the recipient can stop receiving them permanently and free of charge.

Article 136 makes the law effective three months after its publication in the Official Gazette, so these provisions bind today.

When LexLint raises it

crawls_web
trains_models
generates_content
deploys_chatbot
automated_outreach
high_risk_decisions

Read the law

official English translation of the Official Gazette text, hosted by SMEX

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app