NIST Privacy Framework, Control-PCT.DM-P1

On request, give a person access to their data and to information about how any automated decision producing legal effects for them was reached, so they can understand and contest it.

On a data subject's request, confirm whether their data is processed, communicate that data and its origin, purposes, legal basis, categories, and recipients, and provide a copy at no more than reproduction cost, free of the request itself.

Answer a data subject's request to consult their personal data within ten business days, or tell them the reason for delay and a new date no more than five business days later.

Answer an access request with the information in clear language and a copy on payment of no more than the Commission's scale fee, unless the Commission has granted you a response delay or let you disregard a manifestly abusive request.

Let access to medical information be exercised only through a physician the data subject designates.

Answer a request for access with confirmation of whether the person's data are processed, the data themselves and their origin, and the purposes, categories and recipients of the processing.

Give a data subject the information needed to know and contest the processing of their data on request, including confirmation of processing, the purposes, categories, recipients, retention period, and the existence of automated decision-making, and provide an access copy within sixty days.

Answer a data subject's request for access to their personal data within five business days, whether the databank is public or private.

Give a consumer free access to their credit report from a Sociedad de Información Crediticia up to four times a year, at intervals of at least three months, and deliver a requested credit report within five business days.

Let a data subject know whether you are processing their personal data, and give them, free of charge, an intelligible copy of it, telling them its origin and whether it was shared with other institutions.

Confirm free of charge, on request from a data subject who proves their identity, whether you hold personal information about them, and provide it in a reasonable manner, format and prescribed time.

Answer a request for access at reasonable intervals, free of charge and without excessive delay, with confirmation of processing, the data in an intelligible form, their origin and the storage period, in electronic or hard copy at the data subject's preference, and put any refusal in writing with detailed reasons.

On request, confirm whether you are processing a person's personal data, give them a copy of it free of charge, and give them the details of the processing activities.

Confirm within thirty days of a written access request, accompanied by the prescribed processing fee, whether access will be given, and if so give access within sixty days, subject to an extension of up to thirty more days in narrow circumstances.

Let a data subject examine their personal data or give them a copy, providing it in an alternative format where they have a sensory disability.

Let a person access information about themselves held in your database, public or private, in an expedited and cost-free manner.

Answer a data subject's written access request promptly and in any event before the end of 30 days, saying free of charge whether you process their personal data and describing that data, the purposes of the processing and the recipients.

Give a data subject a copy of their personal data on request, along with the purposes, categories, recipients, storage period and other Article 14 information, free of charge for the first copy.

Answer a person's or their heir's question about whether their data is being processed, and give them a copy of the data at their request, in an understandable form where it is encoded, compressed or encrypted.

Give, on the same request, the purposes, categories, source, subject and nature of the processing, the persons and categories of persons the data is sent to or who can access it, and the timing and purposes of that access.

Confirm free of charge, on request from a data subject who proves their identity, whether you hold personal information about them, and provide it in a reasonable manner, format and prescribed time.

Answer a request for access free of charge and without delay, giving the purposes, the data categories, the recipients, the data itself and its origin, and enough information to understand and contest any automated decision-making logic behind a decision that has legal effects.

Let a data subject obtain, without constraint or unreasonable delay and at no expense, confirmation of whether their data is being processed, communication of the data being processed and its source, and communication of the purposes of the processing and the recipients it is disclosed to.

Answer an access request free of charge and without delay with all data concerning the person in an understandable form, its available origin, and the information and reasoning used in any automated processing whose results are used against them.

Give a person, on written request, access to their data in an accessible and intelligible form and its origin, and a copy on payment of no more than the reproduction cost.

Answer an access request with confirmation of processing, a copy of the data in an intelligible form, and the Article 12 information, in the electronic form the person asks for where they submit the request electronically.

Answer a data subject's written request within 15 days, telling them whether their personal data is being processed, the identity of the processor and recipient, the source, purpose and legal grounds of the processing, and their rights of access and rectification, under Article 43.

On request, confirm to a data subject, at reasonable intervals, without delay and free of charge, whether you are processing their personal data, and tell them the purposes, the categories of data, the recipients, and, where available, the data's origin.

On a data subject's request, confirm whether their personal data is held and communicate it to them within a reasonable period on payment of a fee, and give a reasoned refusal in writing where you decline either request.

Answer a data subject's request for information about their personal data within ten business days, in writing, electronically, by phone, by image, or by another means they choose, clearly and covering the whole of their own data without revealing a third party's.

Let a data subject access their data directly, on-site or by copy, and answer their request; where direct access is impossible for processing touching state security, defence or public safety, route the request through the HAPDP instead.

Once Chapter III takes effect, answer a data subject's access request under Article 19 with confirmation of processing, a copy of the personal data, and the processing's purposes, recipients, retention period and source.

Let a data subject access their personal data held in your databases, free of charge, and tell them its origin and purpose.

Give a person access, on request, to the personal data you hold on them, how you collected it, why, at whose request, and what transfers you made or plan to make.

Answer a written access request with the information needed to know and contest the processing, confirmation of whether their data is processed, the data and its known origin, the purposes and categories of recipients, and any transfer envisaged to a third country.

On a data subject's written or electronic request, provide the purposes of processing, a copy of their personal data, a description of what you hold including third-party recipients, the source of data not obtained from them, and whether it was transferred to a third country or an international organisation, subject to the listed exceptions such as another person's rights, legal privilege, or confidential examination materials.

Give a data subject access to their personal data on request and payment of the prescribed fee, describing the data, the purposes of processing, the recipients, and the source of the data.

Let a data subject examine their personal data or obtain a copy, and provide it in an alternative format where the data subject has a sensory disability and it is practicable to do so.

Once Part 5 is in force, respond to a data subject's written access request by disclosing whether you hold personal data about them, describing it, stating the purposes and source of processing, explaining the logic of any automated processing, naming the recipients, and letting them examine or obtain a copy on payment of the prescribed fee, in an alternative format if they have a sensory disability.

On a registered person's request, confirm without unreasonable delay and at no expense whether personal data relating to them is being stored or processed, and provide a copy in a paper-based or commonly used electronic format.

Give a person, on written request, access to their data and its origin, and a copy on payment of no more than the reproduction cost, and refer a disputed mismatch to the CDP for verification.

Answer a person's request to know whether you process their data, and if so give them access to it along with the purpose, categories, recipients and retention period.

On request, confirm free of charge whether you hold a data subject's personal information, and give access to the record within a reasonable time, in a reasonable manner and an understandable form.

Decide a request to make a data subject's personal data available within five working days of registering it, and give reasons in writing for any refusal.

Give a Timor-Leste citizen who asks it access to the personal data you hold about them, whether it sits in a computer system or in mechanical or manual records.

Tell that citizen the purpose of the data you hold about them when they demand it.

Answer an access request by confirming whether you process the person's data, providing it in an accessible form with its origin, purposes, categories and recipients, and any transfer abroad, and deliver a copy at no more than reproduction cost.

Once Part III is in force, respond to an individual's access request within thirty days, either giving the personal information, or a written refusal stating the specific ground and the right of appeal to the Commissioner.

Answer a data subject's request to confirm whether you hold their personal data, describe it, and identify any third party with access to it, within thirty days of the request.

Give a data subject free access, at most every six months, to all information about them held in your database, supplied within five business days, in clear language, covering the whole record without revealing a third party's data.

On a data subject's request, provide confirmation of processing, a copy of their personal data, and information on the purposes, source, recipients, retention period and any planned transfer outside Vanuatu, in writing, in plain language, free of charge and within one month.

Let a person access information and data about themselves or their property that your service holds in a registry, and tell them the use made of it and its purpose.

Answer an access request with the purpose, the categories of data and of recipients, the storage period or the criteria that set it, the data and its source, and the basic logic of any automated decision-making, free of charge for the first copy and in a commonly used electronic format where the request came electronically.