Draft Law on the Protection of Privacy and Personal Data, rights of the data subject

Arts. 10-11 Wet Bescherming Privacy en Persoonsgegevens

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

Proposed: draft date not recorded.

A data subject rights rule binding public and private bodies.

As of 19 September 2026.

What it requires

This measure is a draft bill; it binds nobody yet. What follows is what it would require if it is enacted in this form.
Give a data subject the transparency information article 10(3) lists, including your identity, the purposes and legal basis of processing, recipients, retention period, and their rights, at collection, or, where the data did not come from the data subject, within a reasonable time and at latest within one month.
Give a data subject the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects for them or otherwise significantly affects them, unless a listed exception applies, and never base such a decision on special categories of personal data unless a narrow exception applies with appropriate safeguards.
Let a data subject obtain confirmation that you are processing their personal data, and on request give them the reasons underlying a decision produced by processing their data.
Where processing rests on a contract or consent and is carried out by automated means, give the data subject their personal data in a structured, commonly used, machine readable format, and transmit it directly to another controller where technically feasible.
Let a data subject object at any time to processing on grounds relating to their situation, and stop processing their personal data for direct marketing and any related profiling outright as soon as they object to it.
Rectify or erase a data subject's personal data on request where it has been processed in violation of this law, and let them withdraw consent at any time as easily as they gave it.
Act on a rights request without undue delay and within one month of receipt, extendable by one further month for complex or numerous requests with notice of the extension within three weeks, and if you decline to act, tell the data subject why within one month and of their right to complain to the Commissioner or go to court.
Provide the article 10 information and act on a rights request free of charge, unless the request is manifestly unfounded or excessive, in which case you may charge a reasonable administrative fee or refuse it, bearing the burden of showing it is unfounded or excessive.

What it reaches

Obligation class

Data subject rights, Disclosure

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

This measure is a draft bill; it binds nobody yet, and what follows describes what it would require if enacted in the form read.

Article 10 requires a controller to give a data subject the identity and contact details of the controller and any representative, the data protection officer's contact details where one exists, the purposes and legal basis of the processing, the categories of data, the recipients including any third country recipient, the storage period, the existence of the data subject's rights, and the right to complain to the Commissioner.

That information is due when the data are collected from the data subject, or, where they were not, within a reasonable time and at latest within one month.

Article 11 gives a data subject the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects for them or otherwise significantly affects them, unless a listed exception applies, and bars such a decision from resting on special categories of personal data unless a narrow exception applies with appropriate safeguards.

It also gives a data subject the right to confirmation of processing and to the reasons underlying a decision applied to them, a right to portability of data they provided under a contract or consent and processed by automated means, a right to object at any time to processing on grounds relating to their situation, with processing for direct marketing and its related profiling stopping outright once the data subject objects, a right to rectification or erasure where processing violated this law, and a right to withdraw consent at any time as easily as it was given.

A controller must act on a rights request without undue delay and within one month of receipt, extendable by one further month for complex or numerous requests with notice of the extension within three weeks, and must tell a data subject who it declines to act for why within one month, including the possibility of a complaint to the Commissioner or a court.

Exercising these rights and receiving the article 10 information is free, except that a controller facing a manifestly unfounded or excessive request, particularly a repetitive one, may charge a reasonable administrative fee or refuse it, bearing the burden of showing the request is unfounded or excessive. The bill remains under consideration before De Nationale Assemblee, with no enactment timeline.

When LexLint raises it

crawls_web
trains_models
deploys_chatbot
automated_outreach
high_risk_decisions

Read the law

Draft text of the Ontwerpwet Bescherming Privacy en Persoonsgegevens
as republished by SRiS (Stichting voor de Rechtsorde in Suriname), a Surinamese legal-information foundation, not an official government gazette page the bill's current pendency before De Nationale Assemblee is confirmed on the National Assembly's own list of bills under consideration

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app