Lei n.º 03/2016, rights of the data holder

Lei n.º 03/2016, arts. 10-13 (information, access, opposition and automated decisions)

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force.

A data subject rights rule binding public and private bodies.

As of 19 September 2026.

What it requires

Inform the data holder, at collection, of your identity, the purpose of the processing, and their right of access and rectification, and where you did not collect the data from the holder directly, give that information by the time you register the data or before you first disclose it to a third party.
Answer a data holder's request, free of charge, at reasonable intervals and without undue delay, with confirmation of whether you are processing their data, the purposes, the categories of data and recipients, the data itself in an intelligible form, its origin, and the reasoning behind any automated processing decision about them, and correct, erase or block data that does not comply with this Law.
Let a data holder object, for weighed and legitimate reasons relating to their particular situation, to your continued processing of their data, and stop processing their data for direct marketing or another commercial solicitation, free of charge, as soon as they object or before you first communicate their data to a third party for that purpose.
Do not subject a person to a decision that affects their legal situation or affects them significantly based solely on automated processing that assesses their personality, professional capacity, credit, trustworthiness or behavior, unless the decision is taken in performing a contract at their request with safeguards for their interests, or a law authorizing it protects their rights.

What it reaches

Obligation class

Data subject rights, Disclosure, Access restriction

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Article 10 gives the data holder the right to be told, at collection, the controller's identity, the purposes of the processing, the recipients or categories of recipients, whether a response is obligatory and the consequences of not responding, and the existence and conditions of the rights of access and rectification, and requires that information by the time of registration or before the first communication to a third party where the data were not collected from the holder directly; it excuses the duty where a law provides otherwise, for security or criminal-investigation reasons, or where informing the holder is impossible or disproportionate for statistical, historical or scientific processing, with NAPPD notified in that case.

Article 11 gives the holder free, undue-delay-free access at reasonable intervals to confirmation of whether their data is processed, the purposes, categories and recipients, the data itself in an intelligible form, its origin, the reasoning behind an automated-processing decision about them, and rectification, erasure or blocking of non-compliant data, with third parties who received the data told of any correction; access to health data, including genetic data, runs through a physician of the holder's choosing, and access concerning security or criminal matters runs through the competent authority or NAPPD.

Article 12 gives the holder the right to object, for weighed and legitimate reasons tied to their situation, to continued processing, and an unconditional, free right to stop processing of their data for direct marketing or other commercial solicitation, exercised before the data is first communicated to a third party for that purpose.

Article 13 gives a person the right not to be subject to a decision affecting their legal situation or significantly affecting them based solely on automated processing that assesses their personality, professional capacity, credit, trustworthiness or behavior, unless the decision performs a contract at their request with safeguards for their interests, or a law authorizing it itself protects their rights.

When LexLint raises it

crawls_web
trains_models
deploys_chatbot
automated_outreach
high_risk_decisions
generates_content

Read the law

Lei n.º 03/2016 sobre a Protecção de Dados Pessoais, reproduced by the Network of African Data Protection Authorities (NADPA-RAPDP)

archived copy

Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2023. Publisher's page: https://www.nadpa-rapdp.org/sites/default/files/2020-11/Law_3_2016_protection_of_personal_data.pdf

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app