AzerbaijanLaw on Personal Data, data subject rights
Law of the Republic of Azerbaijan on Personal Data, Law No. 998-IIIQ, Art. 7
In force since .
A data subject rights rule binding public and private bodies.
- Audit expectation
- none
What it requires
- An app holding the personal data of a person in Azerbaijan must give that person the Art. 7 rights on request, including access and correction, must immediately honor a written objection unless processing is legally mandatory, and must let a person object to a decision produced through information-technology processing that harms their interests.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Open questions
- Does the right in Article 7.3 to object to a decision that "violates the subject's interests" apply only to decisions made solely by information technologies, or also to decisions a person makes with their help?
What it makes you log
Logging duty
Article 7 lists the rights of the data subject, including the right to learn who may access the data and to demand proof that collection was lawful (Articles 7.1.4 and 7.1.7), and Article 7.2 requires the owner or operator to stop processing on a written objection. It states no duty to create, keep or produce a log or record. Article 12 on answering requests is not cited by this row. The control-audit journal duty is in Article 9.12, which this row does not cite.
- Kind
- None
- As of
What this law does
Art. 7 gives a data subject the right to learn whether their data is held, to request the legal justification for its collection, processing, or third-party transfer and the consequences of that transfer, to access the data's content, to know the processing purpose, retention period, methods, and who has access, to demand correction and, subject to statutory exceptions, destruction or archiving instead, to demand a ban on collection or processing, to learn the data's source and demand proof of lawful collection, to demand protection, and to receive information about a system's conformity certificate or state examination.
Art. 7.2 adds a written, substantiated objection right that requires the controller to immediately stop processing on receipt unless processing is legally mandatory, and Art. 7.3 adds a right to object to a decision produced through information-technology processing that harms the subject's interests, triggering either a consent-seeking obligation or an immediate processing halt. Art. 7.4 separately gives a damages right, recorded in the enforcement instrument.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .