Ley No. 787, Ley de Protección de Datos Personales, rights of data subjects

Article 7 requires the data controller to inform a data subject, before obtaining their data, of the purpose and possible recipients, the existence and location of responsibility for the file, whether answering is mandatory or optional, the consequences of refusing or of inaccurate data, the data subject's rights of access, rectification, and cancellation, and, where data from public sources are used for advertising, the data's origin and the controller's identity in every communication.

Article 10 gives a data subject a digital right to be forgotten, letting them request that social networks, browsers, and servers suppress and cancel their personal data, and, once a contractual relationship with a public or private institution ends, letting them request that all personal data collected during that relationship be suppressed and cancelled.

Article 12 gives a data subject the right to be informed of the privacy policies a data controller adopts and to be notified of any change to them. Article 16 gives a data subject the right to request information from the Direccion de Proteccion de Datos Personales about the existence of data files, their purposes, and the identity of those responsible for them, through a public and free register.

Article 17 gives a data subject the right to request and obtain information about their personal data processed in public and private data files, including how the data were collected, why, and what transfers or assignments were made, the right to rectify, modify, suppress, complement, include, update, or cancel their data, a response within ten business days of the request, the right of their universal heirs to exercise this article's rights over a deceased person's data, and the right not to be compelled to supply sensitive personal data except as this Act's exceptions allow.

Article 18 requires the information given to a data subject to be clear and simple, to cover the whole of their own data even where they asked about only one aspect, never to reveal a third party's data, and to be supplied in writing, electronically, by phone, by image, or by any other means the data subject chooses, within the controller's technical capacity.

Article 19 gives a data subject the right to have their data rectified, modified, suppressed, complemented, included, updated, or cancelled, requires the data controller to act within five business days of the request and answer in writing, bars cancellation for reasons of social interest, national security, public health, or a third party's rights, requires the controller to notify any assignee of the correction within five business days, requires the controller to block disputed data while verifying a claimed error, and limits retention of the data to five years or the term the parties' contract sets.

Article 20 lets a data controller deny a rectification request only where a judicial decision so orders, and requires the controller to tell the data subject of that decision while still granting them access to their own data to exercise their defense. Article 21 makes exercising the rights of rectification, modification, suppression, complementation, inclusion, updating, and cancellation free of charge to the data subject.

Article 25 lets a data file built for advertising, promotions, offers, or direct sale include personal data only with the data subject's consent or from a publicly accessible source, gives the data subject free access to it, and lets them request removal from it at any time.

Article 26 requires an electronic advertisement to offer its recipient the means to refuse further advertising or revoke their consent, clearly and free of charge, and requires a marketing business to hold a contract proving the personal data it uses were obtained with the data subject's unambiguous, informed consent or from a public access source.