Ley para la Protección de Datos Personales, rights of data subjects

Article 6 gives every data subject the right to know whether their personal data is being processed, to seek its rectification, cancellation or blocking, to object to its processing, to limit future processing to the uses they consented to, to obtain an intelligible copy of their data, and to transfer it, rights their heirs or successors may exercise once the data subject has died.

Article 7 requires a responsible party, including a third party cloud or storage provider it engages, to tell a data subject before collecting their data the purpose, the intended recipients, the existence and safeguards of the database, contact details for the responsible party and its delegate, the content of ARCO POL rights, and the security measures in place, free of charge and revised when the purpose changes.

Article 8 gives a free right of access to a data subject's own information, in clear language without codes, complete unless pseudonymized or dissociated, without revealing a third party's data, and telling the data subject whether their information was shared with other institutions. Article 9 gives a right to rectification within twenty business days, blocking the data under review in the meantime, and lets an unmet deadline ground a complaint to the Entidad Rectora.

Article 10 gives a right to erasure without undue delay on the listed grounds, including withdrawn consent, unlawful processing, a legal duty to erase, or data obtained for direct offers to children, subject to listed exceptions, and includes a right to be forgotten reaching search engine delisting and notice to other responsible parties holding the same data.

Article 11 lets erasure or cancellation instead block the data, keeping it available only to public administration, judges or courts for liabilities arising from the processing. Article 12 gives a right to object to processing, including profiling for commercial or direct marketing purposes, subject to listed exceptions including a child data subject. Article 13 gives a right to limit processing while accuracy or lawfulness is disputed, needed for a claim, or objected to pending review.

Article 14 gives a right to portability, in a structured, commonly used, machine readable and interoperable format, where processing rests on consent and is carried out by automated means.

Articles 15 to 20 require the responsible party to appoint a delegate who manages ARCO POL requests, publishes the privacy notice, and answers a request within twenty business days extendable once by another twenty for justified cause, referring an incompetent request within five business days and curing an incomplete one within ten.

Article 21 fixes how information is delivered and requires the delegate to notify anyone who received data of its later rectification, update or deletion within five business days of granting the request. Article 22 lists the grounds on which a delegate may deny an ARCO POL request, each requiring a reasoned written notice within three business days. Article 23 makes exercising ARCO POL rights free beyond reproduction, certification or delivery costs.

Article 24 requires a privacy notice, consistent with the responsible party's privacy policy, stating the responsible party's address, which data are sensitive, the legal basis, the purposes, the mechanisms for exercising ARCO POL rights and revoking consent, the delegate's contact details, how changes will be communicated, any subcontracted processor's contact details, and cookie use, communicated in writing before the data subject consents.

Articles 46 to 48 preserve for a public body's data subject the rights of access, rectification, a narrower ground for cancellation, objection, and a narrower ground for limitation, exercised through the same procedure as the private sector, and require the public body to tell its users that their data may be collected and processed and how to reach the delegate.