Law on the Protection of Personal Data, data subject rights

Art. 8 gives the subject the right to notice of data collected about them, access, and correction of inaccurate or misleading data, unless legislation provides otherwise.

A separate provision, located near Arts. 9-10 in the text read but not independently numbered with confidence here, requires the possessor, operator, or third party to notify the subject within three working days when their data is transferred to a third party, naming the recipient, the processing purpose, and the data's source, subject to exceptions including the subject's prior consent to the transfer.

Art. 19 requires depersonalization for statistical, sociological, and scientific research use, and Art. 20 requires destruction of data on expiry of the retention period or another statutory trigger. No explicit deletion-on-request or objection-to-processing right distinct from the Art. 8 correction right was found in what was read.

Art. 27 provides that the Law is brought into force after its official publication; the Ministry of Justice's own legal acts portal records the document's start of effect as 3 August 2018, the same day it was signed.