Organic Act on the Protection of Personal Data, rights of the data subject

Article 27 requires the person's express, written consent before processing their personal data, lets that consent be withdrawn at any time, and routes consent for an incapable person through the general rules of law.

Article 29 excuses consent only where processing manifestly serves the person's own interest and contacting them is impossible, obtaining consent would take disproportionate effort, or the processing rests on a law or a contract the person is party to, and article 30 confines a given consent to the form and purpose it was given for, barring use of personal data for advertising without the person's separate, express consent.

Article 31 requires written notice, given at least one month before the data are processed, of the data's nature, the processing's purpose, whether answering is mandatory or optional and the consequences of not answering, the recipient's and controller's identity and address, the person's rights of access, withdrawal and objection, the retention period, a summary of the security measures, and the destination country of any transfer.

Article 32 defines the right of access as the right to consult, correct, complete, rectify, update, clarify or erase data that prove inaccurate, ambiguous or unlawfully processed, and to obtain a copy in clear language and, for automated processing, an intelligible form; article 33 bars waiving that right in advance.

Articles 34 and 36 let the person exercise access at reasonable, non-excessive intervals, against each controller separately where there is more than one, and article 37 requires an automated controller to offer an electronic channel for a rectification, modification, correction or erasure request.

Article 38 gives the person one month to receive a requested copy, one month to bring a refusal or a delay to the INPDP, and the INPDP one month to decide, or seven days where the request is to stop the destruction or concealment of the data; article 39 requires the controller to flag data under dispute until the dispute is resolved.

Article 40 lets the person demand correction, completion, clarification, updating or erasure of data that prove inaccurate, incomplete or ambiguous, or its destruction where it was unlawfully collected or used, and a free copy within one month, escalating a refusal to the INPDP within a further month.

Article 42 gives the person the right to object at any time, for valid, legitimate and serious reasons, to processing of their data, and an unconditional right to object to its communication to third parties for advertising, with the objection suspending the processing immediately; a family court judge, not the INPDP, decides an objection dispute where the person is a child.