North MacedoniaLaw on Personal Data Protection (LPDP), rights of the data subject
Zakon za zastita na licnite podatoci, arts. 16-25 and 27 (rights of the data subject)
In force since .
A data subject rights rule binding public and private bodies.
- Obligation class
- Data subject rights, Disclosure
- Audit expectation
- none
What it requires
- Facilitate the exercise of a data subject's rights under Articles 19 to 26.
- Answer a data subject's access request under Article 19 with confirmation of whether their data are processed and, if so, access to the data along with the listed information, including the purposes, categories, recipients, retention period and source.
- Rectify inaccurate personal data within 15 days of a request under Article 20.
- Erase personal data within 30 days of a request under Article 21 wherever one of its listed grounds applies.
- Stop processing a data subject's personal data for direct marketing once they object under Article 25.
These lines are LexLint's reading of the law's text.
What it makes you log
Logging duty
Articles 16 to 25 and 27 give the data subject information, access, rectification, erasure, restriction, portability and objection rights and set the controller's response duties, and art. 27 lets law restrict them. Article 23 requires the controller to notify recipients of a rectification, erasure or restriction, which is a notice and not a record, and art. 16(5) and art. 25(1) put the burden of proof on the controller in a dispute, without requiring any record. No duty to create, keep or produce a log appears in the cited articles. The register of processing is art. 34, which is not cited on this row.
- Kind
- None
- As of
What this law does
Chapter III, Articles 16 to 27, carries the data subject rights the LPDP models on the General Data Protection Regulation (GDPR), and under Article 122 as amended it applies until North Macedonia's accession to the European Union. Article 16, paragraph 2 requires the controller to facilitate the exercise of the data subject's rights under Articles 19 to 26.
Article 19, paragraph 1 gives a data subject the right to obtain confirmation of whether their personal data are being processed and, where so, access to the data and to information including the purposes of the processing and the categories of data processed. The information also covers the recipients, the retention period and, where the data were not collected from the data subject, their source.
Article 20 gives a data subject the right to have inaccurate personal data rectified by the controller within 15 days of the request, and to complete incomplete data by a supplementary statement. Article 21, paragraph 1 gives a data subject the right to request erasure, which the controller must carry out within 30 days of the request where a listed ground applies.
The grounds include that the personal data are no longer needed for the purposes for which they were collected and that the data subject withdraws the consent on which the processing rests. Article 22 gives a right to restriction of processing, for example while the data subject contests the accuracy of the data.
Article 24, paragraph 1 gives a right to receive the personal data the data subject supplied in a structured, commonly used, machine-readable format and to transmit them to another controller without hindrance, where the processing rests on consent or a contract and is carried out by automated means.
Article 25, paragraph 2 gives a right to object at any time to processing for direct marketing, including the profiling connected to it, and under paragraph 3 the controller then stops processing the data for that purpose.
When LexLint raises it
When your app profile says your app sends automated outreach, makes high-risk automated decisions or processes personal data.
Back to the example · Lint your app
Page updated .