Vatican CityGeneral Regulation on the Protection of Personal Data, data subject rights
Decreto n. DCLVII del 30 aprile 2024 Regulation Arts. 15 to 22 (data subject rights: access, rectification, erasure, portability, objection and restriction)
In force since .
A data subject rights rule binding government bodies.
- Obligation class
- Data subject rights
- Audit expectation
- none
What it requires
- Where this Regulation binds your processing, let the Interested party exercise the right to access, rectify, erase, port, object to and restrict the treatment of personal data you hold about them, by written request, on paper or electronically, addressed to the Data Controller, and answer in writing, including a refusal, within 30 working days, extendable to 90 days in a particularly complex case.
These lines are LexLint's reading of the law's text.
What it makes you log
Logging duty
Articles 15 to 22 set how a data subject makes a request, the 30 working day response period (extendable to 90) and the rights of access, rectification, erasure, portability, objection and restriction. None of them requires a log or a record; the written answer in Article 16(3) is a reply to the person, not a kept record. The Register of treatment activities is Article 9 and the retention period it records is Article 23(2), which this row does not cite.
- Kind
- None
- As of
What this law does
Article 15, paragraph 1 has the Interested party exercise the rights in Title VI by a written request, on paper or electronically, addressed to the Data Controller. Article 16, paragraph 2 sets the response deadline for every right at 30 working days, extendable to 90 days in cases of particular complexity, and paragraph 3 requires a written answer even where the request is refused.
Article 17, paragraph 1 gives the right to obtain confirmation of whether personal data are being treated and access to them. Article 18 gives the right to rectification of personal data without undue delay. Article 19, paragraph 1 gives the right to erasure without undue delay where one of the listed grounds applies.
Article 20, paragraph 1 gives the right to receive the personal data provided to the Data Controller in a structured, commonly used and readable format and to transmit them to another controller outside the scope of the Regulation, where the treatment rests on consent. Article 21 gives a right to object, including to treatment for direct marketing and the profiling connected to it, and Article 22 gives a right to restriction of treatment.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .