Vatican CityGeneral Regulation on the Protection of Personal Data, privacy notice to the data subject
In force since .
A data subject rights rule binding government bodies.
- Obligation class
- Disclosure
- Audit expectation
- none
What it requires
- Where this Regulation binds your processing, give the Interested party a privacy notice on the treatment of their personal data when the data are collected, or within a reasonable period of no more than 30 working days from the date of collection, and in any case at the first communication with them.
- State in the notice general information on the Data Controller, the persons responsible for treatment and the Data Protection Officer, the aim and methods of treatment, its purposes and legal basis, the source of the data, their recipients, any transfer, the retention period, whether an automated decision-making process exists, and how the Interested parties exercise their rights.
- Write the notice concisely, clearly and intelligibly, in plain language a varied audience can understand, on paper or electronically and structured in several layers; give it orally only if other means show the identity of the Interested party who received it.
These lines are LexLint's reading of the law's text.
What record it asks for
Logging duty
Article 8 requires a notice to be given to the Interested party and sets its content and form. It requires no log or record to be kept; the Register of treatment activities is Article 9, which this row does not cite.
- Kind
- None
- As of
What this law does
Article 8, paragraph 1 requires that the Interested party be given a privacy notice on the treatment of their personal data when the data are collected. Article 8, paragraph 1 allows the notice to follow within a reasonable period of no more than 30 working days from the date of collection and in any case requires it at the first communication with the Interested party.
Article 8, paragraph 2 requires the notice to contain general information on the Data Controller and the persons responsible for treatment, general information on the Data Protection Officer, the aim and methods of treatment, its purposes and legal basis, the source, the recipients and any transfer of the data, the retention period, whether an automated decision-making process exists, and how the Interested parties exercise their rights.
Article 8, paragraph 3 requires the notice to be concise, clear, intelligible and easily accessible to the Interested party. Article 8, paragraph 3 also allows the notice to be given orally, provided that the identity of the Interested party who received it is shown by other means.
Article 2, paragraph 1 applies the Regulation, and with it the Article 8 notice duty, to treatment of personal data carried out by the Governorate, within the territory of Vatican City State or in the zones named in Articles 15 and 16 of the Lateran Treaty.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .