Ley 29733, rights of the data subject

Article 18 gives the titleholder a right to be informed, in detailed, simple, express, and unequivocal terms before their data is collected, of the processing's purpose, its recipients, the data bank's existence and its owner's identity and address, whether answering is mandatory or optional, any transfer, the retention period, and how to exercise their rights, and lets a controller collecting data online satisfy this through an easily accessible and identifiable privacy policy; it also requires notice to the titleholder of a new processor engaged after consent was given, or of a new data-bank owner following a merger, portfolio acquisition, or similar transfer.

Article 19 gives a right of access to the information processed about oneself, how it was collected, why, at whose request, and what transfers were made or are planned.

Article 20 gives a right to update, include, rectify, or delete personal data that is inaccurate, incomplete, or obsolete, requires the processor to pass the correction on to anyone the data were previously transferred to, and requires the processor to block the data during the update, inclusion, rectification, or deletion process so no third party can access it, with an exception for a public entity that needs the data for its own competencies.

Article 21 gives a right to prevent the data from being supplied to others, especially where that would affect a fundamental right, though it does not reach the internal relationship between a data bank's owner and its processor. Article 22 gives a right to object to processing, absent the titleholder's consent, on well-founded and legitimate grounds tied to a specific personal situation, requiring deletion where the objection is justified.

Article 23 gives a right not to be subject to a decision with legal effects, or that significantly affects the titleholder, based solely on processing meant to evaluate aspects of their personality or conduct, except within a contractual relationship or an evaluation for entry into a public entity, and preserves the right to state one's own view to safeguard a legitimate interest.

Article 24 lets a titleholder whose rights are denied bring a claim to the Autoridad Nacional de Protección de Datos Personales, whose resolution exhausts the administrative channel and opens the door to a contencioso-administrativo action, or pursue a constitutional habeas data action before the Judiciary instead. Article 25 gives a right to compensation for harm the Law's breach causes.

Article 26 sets the fee for exercising these rights before a public-administration data bank by the general administrative-procedure law and leaves a private data bank's fee to special rules.

Article 27 lets a public-administration titleholder or processor deny access, deletion, or objection on grounds tied to protecting a third party's rights, or to avoid obstructing a pending judicial or administrative proceeding on tax, welfare, criminal, health, environmental, or administrative-infraction matters, or where the law otherwise so provides.