San Marino Law No. 171, rights of the data subject

Legge 21 dicembre 2018 n. 171, articoli 12-22 (diritti dell'interessato)

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force since 21 December 2018.

A data subject rights rule binding public and private bodies.

As of 19 September 2026.

What it requires

Provide a meaningful human review before finalizing a decision based solely on automated processing, including profiling, that produces legal or similarly significant effects for a person in San Marino, under Article 22.
Give a data subject, at collection, your identity and contact details, the purposes and legal basis of the processing, the recipients, any transfer abroad, the retention period and their rights, and where the data came from elsewhere, its source and the categories concerned.
Answer a request for access, rectification, erasure, restriction or portability, and notify every recipient the data was disclosed to of a rectification, erasure or restriction you carry out.
Stop processing personal data for direct marketing as soon as the data subject objects, including the profiling related to it.

What it reaches

Obligation class

Data subject rights, Disclosure

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Article 13 fixes the information a controller gives when it collects personal data from the data subject, and article 14 the information due where the data came from elsewhere.

Article 15 gives a right of access, article 16 a right to rectification, article 17 a right to erasure described as the right to be forgotten, article 18 a right to restriction of processing, article 19 the duty to notify recipients of a rectification, erasure or restriction, article 20 a right to data portability and article 21 a right to object, including to direct marketing.

Article 22 gives the data subject the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them, and where a carve-out applies the controller must implement suitable measures to safeguard the data subject's rights, freedoms and legitimate interests, at least the right to obtain human intervention, to express a point of view and to contest the decision.

Articles 23 and 24 set the restrictions on those rights, including for reasons of justice, and article 25 carries the rights of deceased persons. Law 171/2018 was approved by the Great and General Council on 12 December 2018 and promulgated by the Captains Regent on 21 December 2018, the date carried in the law's own official title, and it states no separate entry-into-force clause, so that promulgation date is the day these provisions began to bind.

When LexLint raises it

crawls_web
trains_models
deploys_chatbot
automated_outreach
high_risk_decisions

Read the law

English-translation PDF hosted by dataguidance.com, read in full (201,720 characters, not truncated)

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app