ArgentinaLey 25.326, rights of data subjects
Ley 25.326, arts. 6, 13-16, 19, 27.3 (data subject rights)
In force since .
A data subject rights rule binding public and private bodies.
- Obligation class
- Data subject rights, Disclosure
- Audit expectation
- none
What it requires
- Before collecting a data subject's personal data, tell them in clear, express terms the purpose it will be processed for and who may receive it, that a file or database exists together with its controller's identity and address, whether answering is mandatory or optional, the consequences of answering, refusing, or answering inaccurately, and that they may exercise access, rectification, and erasure rights.NIST Privacy FrameworkCM.AW-P1
- Let a data subject query the control body's public, free registry to learn what personal-data files exist, their purposes, and their controllers' identity.
- On a verified-identity request, give the data subject their personal data from a public or private reporting database within ten running days, free of charge at intervals no shorter than six months absent a legitimate interest, in clear language without codes, covering the whole record without revealing a third party's data, in the medium the data subject chooses.NIST Privacy FrameworkCT.DM-P1
- Rectify, update, or, where appropriate, delete or restrict a data subject's inaccurate, incomplete, or outdated personal data within five business days of the claim or of learning of the error, and notify any recipient the data were disclosed to within five business days, unless erasure would harm a third party's legitimate rights or a legal duty requires retention.NIST Privacy FrameworkCT.PO-P3NIST Privacy FrameworkCM.AW-P5
- Provide rectification, updating, or erasure of inaccurate or incomplete personal data free of charge, and mark a record as under review while you verify its accuracy.NIST Privacy FrameworkCT.PO-P3
- Let a data subject request the removal or blocking of their name from an advertising, direct-marketing, or profiling database at any time.NIST Privacy FrameworkCT.PO-P3
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
- CT.DM-P1Data elements can be accessed for review.
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
- CM.AW-P5Data corrections or deletions can be communicated to individuals or organizations (e.g., data sources) in the data processing ecosystem.
- FINOS AIGF
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Articles 6, 13 to 16, 19 and 27(3) set the information a controller gives at collection, the public register consultation right, the access right with a ten-day reply, and rectification within five working days with notice to recipients. Article 16(6) asks for a file to be blocked or marked as under review during a dispute, and Article 16(7) keeps data for the periods the rules or contracts set. None of these requires a log or record of processing or names an audit. The public register in Article 13 is the control body's, not a record the controller keeps.
- Kind
- None
- As of
What this law does
Article 6 requires telling a data subject, before their personal data is collected, the purpose for which it will be processed and the recipients or classes of recipients, that a file, registry, or database exists together with its controller's identity and address, whether answering the questionnaire is mandatory or optional, the consequences of providing the data, refusing to, or giving inaccurate data, and that they may exercise access, rectification, and erasure rights.
Article 13 lets any person query the control body's public, free registry to learn what personal-data files exist, their purposes, and their controllers' identity.
Article 14 gives the data subject, once their identity is verified, the right to request and obtain their personal data from a public or private reporting database, to be answered within ten running days, exercisable free of charge at intervals no shorter than six months absent a legitimate interest, and exercisable by a deceased person's universal successors.
Article 15 requires the information to be given clearly, without codes, in plain language, covering the subject's whole record without revealing a third party's data, in the medium of the data subject's choice.
Article 16 gives a data subject the right to have their inaccurate, incomplete, or outdated personal data rectified, updated, or, where appropriate, deleted or made confidential, requires the controller to act within five business days of the claim or of learning of the error, requires notifying any recipient the data were disclosed to within five business days, bars erasure where it would harm a third party's legitimate rights or a legal duty requires retention, and requires marking a record under review while its accuracy is verified.
Article 19 makes rectification, updating, or erasure of inaccurate or incomplete personal data free of charge. Article 27.3 lets a data subject request the removal or blocking of their name from an advertising, direct-marketing, or profiling database at any time.
When LexLint raises it
When your app profile says your app sends automated outreach, makes high-risk automated decisions or processes personal data.
Back to the example · Lint your app
Page updated .