Law on Personal Data Protection, rights of the data subject

Law on Personal Data Protection, arts. 11, 20-21, 23, 43-46 (rights of the data subject)

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

Commencement not set.

A data subject rights rule binding public and private bodies.

As of 19 September 2026.

What it requires

Erase personal data that was not obtained from the data subject directly within 30 days of a request to do so, under Article 11.
Tell a data subject, when you collect their personal data directly, your name and address, the purpose of processing, the recipients or categories of recipients, and the existence of their rights of access and rectification, under Article 20, and give the same information no later than when processing begins where the data were not obtained from the data subject directly, under Article 21.
Erase personal data whose processing does not comply with the law on the data subject's request, and notify the data subject and any recipient of an alteration, supplementing or erasure within 8 days, under Article 23.
Answer a data subject's written request within 15 days, telling them whether their personal data is being processed, the identity of the processor and recipient, the source, purpose and legal grounds of the processing, and their rights of access and rectification, under Article 43.
Supplement, alter or erase inaccurate or incomplete personal data, or block personal data whose use does not comply with the law, within 15 days of a data subject's request, under Article 44.
Expect the rights in Articles 43 and 44 to be restricted only for defence, national or public security, detection and prosecution of criminal offenders, or protection of economic, financial or cultural state interests, to the extent necessary and only under a separate law, under Article 45, and bear the cost of an Article 43 or 44 proceeding yourself, under Article 46.

What it reaches

Obligation class

Data subject rights, Disclosure

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Article 11 lets a data subject request erasure of personal data that was not obtained from him directly, and requires the controller to erase it within 30 days of the request.

Article 20 requires the controller or processor to give a data subject, from whom data are collected directly, information including the purpose of processing, the recipients or categories of recipients, and the existence of the rights of access and rectification, and Article 21 imposes the same duty, no later than when processing begins, where the data were not obtained from the data subject directly.

Article 23 lets a data subject request erasure of personal data whose processing does not comply with the law, and requires the controller to notify the data subject and any recipient of an alteration, supplementing or erasure within 8 days.

Article 43 requires the controller to notify a data subject, on written request, within 15 days of whether personal data concerning him are undergoing processing, the identity of the processor and recipient, the source, purpose and legal grounds, and the rights of access and rectification, and Article 44 requires the controller, within the same 15 days, to supplement, alter or erase inaccurate or incomplete personal data, or block the use of personal data whose use does not comply with the law.

Article 45 lets the rights set out in Articles 43 and 44 be restricted for defence, national and public security, the detection and prosecution of criminal offenders, or the protection of economic or financial interests or cultural assets of importance for the state, to the extent necessary and only under a separate law, and Article 46 puts the cost of an Article 43 or 44 proceeding on the controller.

When LexLint raises it

crawls_web
trains_models
deploys_chatbot
automated_outreach
generates_content

Read the law

70/09-consolidated English translation hosted by the Agency for Personal Data Protection and Free Access to Information (azlp.me)
read in full (54,193 characters, not truncated)

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app