Law No. 06/L-082 on Protection of Personal Data, rights of the data subject

Law No. 06/L-082 on Protection of Personal Data, arts. 11-22, 74 (rights of the data subject)

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force since 12 March 2019.

A data subject rights rule binding public and private bodies.

As of 19 September 2026.

What it requires

Answer an access, rectification, erasure, restriction, portability or objection request within one month of receipt, extendable by two further months for complex or numerous requests, and tell the data subject about any extension within the first month.
Tell a data subject, at the point you collect or first obtain their personal data, your identity, the purposes and legal basis of processing, the recipients, any transfer to a third country, the storage period, and their rights, within one month where the data came from elsewhere.
Give a data subject a copy of their personal data on request, along with the purposes, categories, recipients, storage period and other Article 14 information, free of charge for the first copy.
Correct inaccurate or incomplete personal data on request without undue delay.
Erase personal data on request without undue delay where it is no longer necessary, consent is withdrawn with no other lawful basis, the data subject objects with no overriding ground, it was processed unlawfully, a legal obligation requires erasure, or it was collected under the child information-society-service consent rule.
Restrict processing on request while accuracy is contested, in place of erasure where the data subject prefers restriction, where you no longer need the data but the data subject does for legal claims, or while an objection is being verified, and tell the data subject before lifting the restriction.
Pass on any rectification, erasure or restriction to every recipient the data were disclosed to, unless that is impossible or disproportionately difficult, and tell the data subject who those recipients are on request.
Give a data subject their data in a structured, commonly used, machine-readable format and transmit it to another controller on request where processing rests on consent or a contract and is automated.
Stop processing personal data for direct marketing, including related profiling, as soon as a data subject objects, and bring that right to their attention explicitly and separately no later than the first communication with them.
Where you rely on Article 74's specific direct-marketing procedure, stop the marketing use within eight days of receiving a written objection and confirm that in writing to the data subject within a further five days.
Do not subject a data subject to a decision based solely on automated processing, including profiling, that produces legal effects or similarly significantly affects them, unless a listed exception applies and you provide the required safeguards, including the right to obtain human intervention.

What it reaches

Obligation class

Data subject rights, Disclosure, Access restriction

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Article 11 requires the controller to give the Article 12 and 13 information and handle an Article 14 to 21 request in a concise, transparent, intelligible and easily accessible form, free of charge and within one month of the request, extendable by a further two months for complex or numerous requests.

Articles 12 and 13 set the information a controller must give a data subject, whether the data came from the subject or elsewhere, covering the controller's identity, the purposes and legal basis of processing, the recipients, any transfer to a third country, the storage period, and the data subject's rights. Article 14 gives a right of access to confirmation of processing, a copy of the personal data, and the accompanying information the article lists.

Article 15 gives a right to rectification of inaccurate personal data and completion of incomplete data. Article 16 gives a right to erasure, the right to be forgotten, on the listed grounds, including withdrawal of consent, unlawful processing, and collection under Article 7's information-society-service consent rule.

Article 17 gives a right to restriction of processing where accuracy is contested, processing is unlawful, the controller no longer needs the data but the data subject does for legal claims, or an Article 20 objection is pending verification. Article 18 requires the controller to communicate any rectification, erasure or restriction to every recipient the data were disclosed to, unless that proves impossible or disproportionately difficult.

Article 19 gives a right to data portability in a structured, commonly used and machine-readable format where processing rests on consent or a contract and is carried out by automated means. Article 20 gives a right to object to processing based on the controller's or a third party's legitimate interest, and a separate, unconditional right to object to processing for direct marketing purposes, including related profiling.

Article 21 gives a right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects or similarly significantly affects the data subject, subject to the listed exceptions and safeguards.

Article 74 lets a data subject demand in writing that a controller stop using their personal data for direct marketing, requires the controller to stop within eight days of receiving the objection, and requires written confirmation to the data subject within a further five days.

Article 22 lets these rights be restricted, consistently with the essence of fundamental rights and freedoms, only where necessary and proportionate to safeguard the listed public interests, including state security, defence, public safety, and the prevention, investigation, detection or prosecution of criminal offences.

When LexLint raises it

crawls_web
trains_models
deploys_chatbot
automated_outreach
high_risk_decisions
generates_content

Read the law

Official Gazette of the Republic of Kosovo (gzk.rks-gov.net), act detail page, full 111-article Albanian text

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app