NIST Privacy Framework, Govern-PGV.MT-P7

Where you deny an access request, state the specific statutory ground in the refusal notice, tell the data subject of the right to complain to the Information Commissioner, and treat a failure to respond within the time limits as a deemed refusal.

Correct personal data on a data subject's written application where it is incomplete, incorrect, misleading, excessive or irrelevant to the purpose it is held for, without obliterating the pre-amendment text of the document, or give written reasons for refusing and tell the data subject of the right to complain to the Information Commissioner within twenty-eight days.

Give a data subject written reasons where you deny an access request, and let them challenge those reasons.

Give persons performing platform work access to a contact person you designate to discuss and clarify the facts, circumstances and reasons that led to such a decision, and ensure the contact person has the competence, training and authority necessary to exercise that function (Article 11(1)).

Respond to a consumer rights request without undue delay and no later than 45 days after receipt, with one 15-day extension available when reasonably necessary, and decide an appeal of a denial within 60 days.

An app holding the personal data of a person in Georgia must give that person a way to withdraw consent and to appeal, and must act on a request to exercise their Chapter III rights on demand.

Respond to a consumer rights request without undue delay and within 90 days of receipt, with one 45-day extension available, and decide an appeal of a refusal within 60 days.

Respond to a consumer rights request without undue delay and within 45 days of receipt, with one 45-day extension available, and decide an appeal within 60 days of receipt.

Give a data subject written reasons where you deny an access request, and let them challenge those reasons.

Respond to a consumer rights request without undue delay and no later than 45 days after receipt, with one 45-day extension available, and respond to an appeal of a refusal within 60 days.

Respond to a consumer rights request no later than 45 days after receipt, with one 45-day extension available if you tell the consumer the reason within the initial period, and provide a conspicuous process to appeal a refusal.

Develop and follow the policies and practices you need to meet the Act, develop a process for responding to complaints, and make information about both available on request.

Give individuals access to their own personal information on request and a way to challenge the organization's compliance with these obligations.

As a data processor, keep personal data secure in the same way, update or correct it as the controller instructs within five business days, and adopt an internal manual of policies and procedures for handling consultations and claims.

Let a subscriber require you to correct or remove information relating to them, and handle any complaint about how you responded to that request.

Make available to individuals your policies and practices for managing personal information, and give an individual the ability to challenge your compliance with these Principles and a timely, appropriate response.

Compile and record, for each calendar year, the policies, decisions and actions taken to implement this Chapter and the complaints received about it, including how many were received, which principles they alleged were contravened, and how they were resolved.

Establish a process for natural persons residing in the Republic to submit complaints about alleged violations of the personal data protection principles, consistent with any guidance the competent authority adopts, and retain records of the complaints and any action taken.

Answer a rights-protection request the Secretaría serves on you within fifteen days, offering the evidence and arguments you rely on.

Let a data subject or their representative lodge a complaint with the Commissioner about your processing, and give reasonable assistance to a person who wants to put a complaint in writing.

Respond within seven working days to a decision the Authority issues on a data subject's complaint against you, after the Authority has decided the complaint within thirty days of it being filed.

Provide prominent, accessible, and responsive tools to help children, or their parents or guardians, exercise their privacy rights and report concerns.

Establish procedures and redress mechanisms that let users lodge complaints with you within a reasonable timeframe to present their views (Article 3(1), point (g)(iv)). Inform users in a clear, prominent and comprehensible way that you have invoked the derogation from Article 5(1) and Article 6(1) of Directive 2002/58/EC solely for these purposes, of the logic behind the measures you have taken and of the impact on the confidentiality of users' communications, including the possibility that personal data are shared with law enforcement authorities and organizations acting in the public interest against child sexual abuse (Article 3(1), point (g)(v)). Where a user's content has been removed, an account blocked or a service suspended, inform the user of the avenues for seeking redress from you, the possibility of lodging a complaint with a supervisory authority and the right to a judicial remedy (Article 3(1), point (g)(vi)).