LiechtensteinGDPR Articles 12-21 and DSG Articles 27 and 35, Data Subject Rights in Liechtenstein
In force since .
A data subject rights rule binding public and private bodies.
- Audit expectation
- none
What it requires
- Honor a person's request to access, rectify, erase, restrict, port, or object to processing of their personal data in Liechtenstein within one month of receipt.
- You may restrict the rights of access, rectification, restriction and objection in Liechtenstein to the extent they would likely make scientific or historical research or statistics impossible or seriously impair it, and refuse access to data needed for scientific research where giving it would take disproportionate effort, under DSG Article 27(4).
- Where erasing a person's data in Liechtenstein is impossible or disproportionately costly because of how it is processed or stored, and their interest in erasure is low, restrict its processing instead of erasing it, unless the data were processed unlawfully, under DSG Article 35(1).
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What record it asks for
Logging duty
Article 35(1) replaces erasure with restriction of processing where erasure is impossible or disproportionately costly, and Article 27(4) narrows the research and statistics rights. Neither requires a record. GDPR Articles 12 to 21 set how a controller answers a request, with no register or log of requests. The duty to document the reasons for refusing access sits in Chapter III of the Act (processing by the criminal-justice bodies) and is not in a section this row cites. The row's sections have no scope clause, so no territorial hook is coded.
- Kind
- None
- As of
What this law does
Under General Data Protection Regulation (GDPR) Articles 12 to 21, a person in Liechtenstein can ask a controller for access to their personal data and for its rectification, erasure, restriction or portability, or object to its processing, and the controller must answer within one month, a period it may extend by two further months for complex or numerous requests. The Datenschutzgesetz narrows these rights twice.
Article 27(4) restricts access, rectification, restriction and objection where they would likely make scientific or historical research or statistics impossible or seriously impair it, and lets a controller refuse access to data needed for scientific research where giving it would take disproportionate effort.
Article 35(1) replaces erasure with restriction where the way the data are processed or stored makes erasure impossible or disproportionately costly and the person's interest in it is low, unless the data were processed unlawfully.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .