Ley No. 172-13 sobre Protección Integral de los Datos Personales, rights of data subjects and habeas data

Article 7 gives every person a judicial right of consultation to learn of and access the data recorded about them in a public or private register or databank, and to demand suspension, rectification, or updating where the data is discriminatory, inaccurate, or erroneous.

Article 8 gives a data subject the right to have their personal data rectified, updated, or, where appropriate, suppressed, and requires the data controller, once it has verified the claim, to carry out the correction, suppression, or update within ten business days of receiving the request or discovering the error, to notify any recipient the data was disclosed to within five business days of the correction, and to make the correction free of charge.

Article 9 makes the rights of access, rectification, cancellation, and opposition independent of one another, so exercising one is never a precondition for exercising another.

Article 10 gives every person the right to access the data about them or their property held in official or private registers, to learn how it is used, and, before a competent judge, to seek its updating, correction, or destruction where it illegitimately affects their rights, and requires a databank user to answer an access request within five business days.

Article 11 gives a data subject the right to request their credit history or credit report from a Sociedad de Información Crediticia free of charge up to four times a year, at intervals of at least three months, unless a legitimate interest justifies more frequent access, and lets them view it at the bureau's offices or request secure access through an internet platform.

Article 12 requires a Sociedad de Información Crediticia to make the requested credit report available to the data subject within five business days of receiving the request.

Articles 17 through 24 give a data subject the judicial habeas data action to learn of, access, correct, suppress, or update personal data held in a public or private archive, register, or databank, set out who may bring and defend the action, fix the competent court as that of the defendant's domicile, and follow the amparo procedure, requiring the defendant archive to state, in answering the claim, its reasons for including the disputed information.

Article 16 gives a person harmed by a violation of the law the right to be indemnified under ordinary civil law.

Article 25 gives a data subject who disputes information in a Sociedad de Información Crediticia report the right to file a claim, requires the bureau to forward it to the data furnisher within ten business days, requires the data furnisher to answer in writing within ten business days, requires the disputed record to carry the legend Registro Impugnado por Habeas Data until the dispute is resolved, and requires a correction to be made within five business days once the furnisher accepts it or a final judgment favors the data subject.

Article 44 gives a data subject listed in a professional directory the free right to have their data excluded from advertising or commercial prospecting, and article 71 gives every data subject the right to request, at any time, that their name be withdrawn or blocked from a databank used for marketing, mailing, advertising, or direct sale.

Article 26 lets a court deny access, rectification, or suppression from an official databank to protect national security, public order and safety, or the rights and interests of third parties, or where disclosure would hinder a pending judicial or administrative investigation into tax compliance, health or environmental oversight, crime, or an administrative infraction.