LuxembourgGDPR Articles 12-21 and Loi du 1er aout 2018 Article 63, Data Subject Rights in Luxembourg
Regulation (EU) 2016/679, Arts. 12-21; Loi du 1er aout 2018, Arts. 63, 65
In force since .
A data subject rights rule binding public and private bodies.
As of .
What it requires
- Honor a person's request to access, rectify, erase, restrict, port, or object to processing of their personal data in Luxembourg within one month of receipt.
- If you process personal data in Luxembourg for scientific or historical research or for statistics, you may depart from the rights of access, rectification, restriction and objection (General Data Protection Regulation (GDPR) Articles 15, 16, 18 and 21) to the extent they would make that purpose impossible or seriously impair it, provided you take the additional safeguards Article 65 requires, under Loi du 1er aout 2018 Article 63.
What this law does
Under General Data Protection Regulation (GDPR) Articles 12 to 21, a person in Luxembourg can ask a controller for access to their personal data and for its rectification, erasure, restriction or portability, or object to its processing, and the controller must answer within one month, a period it may extend by two further months for complex or numerous requests.
The Loi du 1er aout 2018 narrows these rights for research: a controller processing for scientific or historical research or for statistics may depart from the rights of access, rectification, restriction and objection to the extent they would make that purpose impossible or seriously impair it, provided it takes the additional safeguards Article 65 lists.
When LexLint raises it
When your app profile says your app crawls the web, trains models, generates content with AI, deploys a chatbot or sends automated outreach.