Loi sur la Protection des Données Personnelles, droits de la personne concernée

Loi n. 1.565 du 3 decembre 2024, arts. 10-20 (rights of the data subject)

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force since 13 December 2024.

A data subject rights rule binding public and private bodies.

As of 19 September 2026.

What it requires

Act on a data subject's rights request concisely, understandably, and in an easily accessible form, in clear and plain language, with particular care where the information is meant for a minor, and answer within one month of receipt, extendable by two months for a complex or repeated request.
Tell a person, at the point you collect their data, who you are, the purposes and legal basis of the processing, any legitimate interest relied on, the categories of data, the retention period or the criteria for setting one, whether a reply from them is mandatory, the right to withdraw consent, the recipients, how to exercise their rights, the right to complain to the Authority, whether automated decision making including profiling is in use, and any transfer outside Monaco and its safeguards.
Answer an access request with confirmation of processing, a copy of the data in an intelligible form, and the Article 12 information, in the electronic form the person asks for where they submit the request electronically.
Correct inaccurate or incomplete personal data without delay on request, including by adding a supplementary statement.
Erase personal data without delay on request in the listed cases, such as withdrawn consent with no other legal basis, a successful objection, data no longer necessary for its purpose, unlawfully processed data, or data collected from a minor for an information society service, and tell any third party you disclosed it to that it must be erased too.
Restrict processing on request in the listed cases, keep the data stored but otherwise untouched without the person's consent while the restriction lasts, and tell the person before you lift it.
Notify every recipient the data were disclosed to of a rectification, erasure, or restriction, unless that is impossible or would take disproportionate effort.
Stop processing a person's data for direct marketing, including any profiling tied to it, the moment they object, and flag that right to them clearly and separately no later than the first communication.
Give a person their data in a structured, commonly used, machine readable format on request, and transmit it directly to another controller where that is technically possible.
Do not base a decision that produces legal effects for a person or significantly affects them solely on automated processing, including profiling, unless a listed exception applies, and where it does, guarantee at least the right to obtain human intervention, express a view, and contest the decision.
Let a deceased person's ascendant, descendant to the second degree, surviving spouse, cohabitant, or registered partner exercise the access, rectification, erasure, restriction, objection, and portability rights over that person's data where they show an interest.

What it reaches

Obligation class

Data subject rights, Disclosure, Access restriction

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Article 10 requires the controller to act on a rights request concisely, understandably, and in an easily accessible form, in clear and plain language, with particular care where the information is meant for a minor, and to answer within one month of receipt, extendable by two months for a complex or repeated request.

Article 11 lists what a controller must tell a person at collection, its identity and contact details, the purposes and legal basis of the processing, any legitimate interest relied on, the categories of data, the retention period or the criteria for setting one, whether a reply is mandatory, the right to withdraw consent, the recipients, how to exercise the access, objection, rectification, erasure, restriction, or portability rights, the right to complain to the Authority, the data protection officer's contact details if any, the existence of automated decision making including profiling, and any transfer outside Monaco and its safeguards under Articles 97 to 100.

Article 12 gives a right of access to confirmation of processing and a copy of the data, Article 13 a right to rectification, and Article 14 a right to erasure in the listed cases, including where the data were collected from a minor for an information society service and the person later asks for their removal.

Article 15 gives a right to restrict processing in the listed cases, and Article 16 requires every recipient the data were disclosed to be told of a rectification, erasure, or restriction unless that is impossible or disproportionately burdensome. Article 17 gives an unqualified right to object to processing for direct marketing, including any profiling tied to it, which the controller must flag separately no later than the first communication.

Article 18 gives a right to receive personal data in a structured, commonly used, and machine readable format and to have it transmitted directly to another controller where technically possible. Article 19 bars a decision that produces legal effects or significantly affects a person from resting solely on automated processing, including profiling, unless a listed exception applies, and even then guarantees at least a right to human intervention, to express a view, and to contest the decision.

Article 20 lets a deceased person's ascendant, descendant to the second degree, surviving spouse, cohabitant, or registered partner exercise the access, rectification, erasure, restriction, objection, and portability rights over that person's data where they show an interest.

When LexLint raises it

crawls_web
trains_models
deploys_chatbot
automated_outreach
high_risk_decisions
generates_content

Read the law

Journal de Monaco n. 8725 and the consolidated text at legimonaco.mc, both read in full (179,076 characters at legimonaco.mc, not truncated)

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app