Data Protection Act, 2023, information to the data subject and rights of the data subject

Data Protection Act, Law No. 005 of 2023, arts. 18 and 20-23 (information and rights of the data subject)

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force.

A data subject rights rule binding public and private bodies.

As of 19 September 2026.

What it requires

Before you collect personal data, tell the data subject who you are, the basis and purposes of the processing, who you will share the data with, their rights and their right to complain to the Authority, and describe any automated decision-making and its likely consequences.
On request, confirm whether you process a person's personal data and where it came from, give them a copy in a commonly used electronic format, and correct or delete data that is inaccurate, out of date, incomplete or misleading, at no expense and without unreasonable delay.
Let a data subject withdraw consent as easily as they gave it, and tell them what withdrawing means.
Stop processing personal data a data subject validly objects to, unless a public interest or other legitimate ground outweighs the unwarranted damage or distress.
Do not base a decision that produces legal or similar significant effects on a person solely on automated processing, including profiling, unless a contract, a written law with safeguards, or the person's consent authorises it.

What it reaches

Obligation class

Disclosure, Data subject rights

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Article 18 requires a data controller to inform a data subject, before it collects their personal data, of the controller's identity and contact details, the basis and purposes of processing, who the data will be shared with, the data subject's rights and right to complain to the Authority, and a description of any automated decision-making, including profiling, and its likely consequences.

Article 20 gives a data subject the right to obtain, at no expense and without unreasonable delay, confirmation of whether their personal data is being processed and its source, a copy in a commonly used electronic format, correction or deletion of inaccurate, out of date, incomplete or misleading data, and deletion of data the controller is not entitled to retain. Article 21 gives the right to withdraw consent and requires withdrawal to be as easy as giving it.

Article 22 gives the right to object to processing that causes substantial unwarranted damage or distress on the grounds it names. Article 23 gives the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal or similar significant effects, except where the decision is necessary for a contract, authorised by a written law with safeguards, or authorised by the data subject's consent.

The Act comes into force on adoption by the Federal Parliament, promulgation by the President and publication in the Official Bulletin, and no publication date has been located, so the day it took effect is not stated here. The Act is operative: in January 2026 the Authority announced that the Council of Ministers had approved regulations issued under article 41.

When LexLint raises it

high_risk_decisions
automated_outreach
deploys_chatbot
crawls_web
trains_models

Read the law

Text of the Data Protection Act, Law No. 005 of 2023, reproduced by DataGuidance
the Data Protection Authority names the Act and its own copy of the text is not available

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app