Loi n° 2022-59, droits des personnes concernées

Loi n° 2022-59, arts. 51-52 et 68-76 (droits des personnes concernées)

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force.

A data subject rights rule binding public and private bodies.

As of 19 September 2026.

What it requires

Give the data subject information about the processing no later than the time you collect their data.
Let a data subject access their data directly, on-site or by copy, and answer their request; where direct access is impossible for processing touching state security, defence or public safety, route the request through the HAPDP instead.
Correct, complete, update, lock or erase inaccurate, incomplete, ambiguous or outdated data within one month of a request from the person or a deceased person's heirs.
Do not use a person's data for direct marketing without their prior consent, and stop processing their data for direct marketing, free of charge, as soon as they object, telling them of that right before you first use or disclose their data for that purpose.
Erase a person's data on request where consent is withdrawn, the processing purpose has lapsed, the processing is unlawful, or the data concerns a minor, unless a listed retention ground applies.
Where you have made a person's data public online, take reasonable steps, including technical measures, to tell any third party processing that data to remove links to it, or any copy or reproduction, on the person's request (the right to digital erasure).
Let a person obtain a temporary freeze on the use of some of their data on request (the right to restriction of processing).
Give a person a copy of their data in a structured, commonly used, machine-readable electronic format on request, and transmit it directly to another controller where that is technically possible.
Do not base a judicial, administrative or private decision assessing a person's behaviour or personality solely on automated processing, and let the person know and contest the criteria, data and reasoning behind an automated or artificial-intelligence-based decision used against them.

What it reaches

Obligation class

Data subject rights, Disclosure, Access restriction, Prohibition

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Article 68 requires the controller to give the data subject information about the processing no later than the time of collection.

Article 69 gives a data subject a direct right of access to their data, by on-site consultation or by copy, and lets the HAPDP exercise that access on the person's behalf, ordering rectification, erasure or locking of non-compliant data, when direct access is impossible; article 70 substitutes an indirect right of access through a HAPDP-designated investigator for processing touching state security, defence or public safety.

Article 71 gives a person, or a deceased person's heirs, the right to have inaccurate, incomplete, ambiguous or outdated data rectified, completed, updated, locked or erased within one month of the request.

Article 51 bars any direct-marketing solicitation using a person's data without their prior consent, and article 72 gives a person the right to object to processing for legitimate reasons particular to their situation and an unconditional right to object, free of charge, to processing for direct marketing, with prior notice before their data is first used or disclosed for that purpose.

Article 73 gives a person the right to erasure of unlawfully processed, withdrawn-consent or purpose-lapsed data, including data concerning a minor, subject to listed retention exceptions, and article 74 gives a right to digital erasure requiring the controller to tell any third party who processed data made public online to delete it as well.

Article 75 gives a right to a temporary freeze on the use of some of a person's data, and article 76 gives a right to receive a copy of one's data in a structured, commonly used, machine-readable format and to have it transmitted directly to another controller.

Article 52 bars a judicial, administrative or private decision assessing a person's behaviour or personality from resting solely on automated processing, and gives every person the right to know and contest the criteria and reasoning an automated or artificial-intelligence-based decision used against them.

When LexLint raises it

crawls_web
trains_models
deploys_chatbot
automated_outreach
high_risk_decisions

Read the law

Loi n 2022-59 du 16 decembre 2022, version consolidee, Haute Autorite de Protection des Donnees a Caractere Personnel

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app