Personal Data Subject Rights
The law establishes specific and enforceable rights for data subjects. Controllers must implement procedures to handle requests within established timeframes.
Last updated:
Enforceable Rights
Rights are directly enforceable against the data controller. Their exercise cannot be conditioned on payment of fees. The general response period is 15 business days, extendable by an additional 15 business days.
This page reviews each right the law grants the data subject, what it covers, and the steps of the procedure before the controller.
The rights of the data subject
Each card sets out one right, what it covers and how it plays out in practice.
Right of Access
Obtain confirmation about processing and access personal data.
Information to Provide
- Data processed and purposes
- Data recipients
- Retention period
- Available rights
Right to Rectification
Correct inaccurate, outdated or incomplete data.
Application
- Inaccurate or erroneous data
- Outdated information
- Incomplete data
Obligations
- Immediate correction
- Notification to recipients
Right to Erasure
Delete data when its necessity for processing purposes ceases.
Grounds
- Unnecessary data
- Withdrawal of consent
- Unlawful processing
- Legal obligation to delete
Limitations
- Freedom of expression
- Legal obligation to retain
- Public interest
Right to Object
Object to processing based on legitimate interest or public interest.
Grounds
- Particular situation of the data subject
- Lack of proportionality
- Impact on fundamental rights
Effects
- Cessation of processing
- Assessment of overriding interests
Right to Data Portability
Receive data in a structured and readable format to transmit it to another controller.
Requirements
- Processing based on consent or contract
- Automated means
- Data provided by the data subject
Modalities
- Direct delivery to data subject
- Transmission between controllers
Right to Restriction
Temporarily suspend processing while other requests are being resolved.
Application
- Pending rectification
- Opposition assessment
- Lawfulness challenge
Effects
- Suspension of operations
- Storage without processing
Opposition to Automated Decisions
Limit decisions based exclusively on automated processing with significant effects.
Scope
- Algorithmic decisions without human intervention
- Profiling
- Automated scoring
Safeguards
- Human review
- Expression of point of view
- Right to challenge
Recognizing a right is one thing; exercising it is another. The procedure below sets out the usual path.
Exercise Procedure
Formal procedure with specific deadlines and appeal mechanisms before the Agency.
- Data Subject Request
Submission by physical or electronic means, identifying the right to be exercised.
- Verification
The controller may verify the identity of the requester.
- Response
Deadline of 30 calendar days, extendable by an additional 30 days.
- Appeal to Agency
30 business days to file a claim with the Agency in case of denial or lack of response.
Frequently asked questions
Common questions about exercising data subject rights.
What rights does Law 21.719 grant data subjects?
The law sets out ARCO+ rights: access, rectification, cancellation, opposition, portability and blocking of processing. It also includes the right not to be subject to significant automated decisions without human intervention and the right to transparency about processing.
How is the right of access exercised?
By application to the controller identifying the subject and the data requested. The controller must respond within 30 working days, providing information on data processed, purposes, recipients, retention and origin. The response is free of charge for the first request each year.
What if the controller does not respond?
The subject may complain to the Data Protection Agency. Omission is a serious breach of Law 21.719 with fines up to 10,000 UTM. The Agency may order forced compliance and publish the sanction.
What is the right to data portability?
It lets the subject receive their data in a structured, commonly used and machine-readable format and transmit it to another controller when processing relies on consent or contract performance and is carried out by automated means. It is key in banking, health and telecommunications.
Can the subject object to all processing of their data?
The right to object applies on grounds related to the subject's particular situation when processing relies on the controller's legitimate interest. For automated decisions, direct marketing and profiling, objection is always applicable.
Transform Your Legal Challenges into Competitive Advantages
Discover how our innovative approach can drive your business
