#
Core access/rectification/erasure/objection rights are codified and were substantially strengthened by the 2020/2022 amendments; residual amber factor is the absence of a fixed response-time statute and of an explicit portability right.
Sub-modules (5)
Access RightGreen
Data subjects may demand disclosure of retained personal data; businesses must respond without delay, subject to limited harm-based exceptions.
Claims (2):
- Data subjects have the right to demand disclosure of retained personal data held by a business operator.
- A business operator must disclose retained personal data to a data subject without delay, subject to statutory exceptions such as risk of harm to life or improper interference with business operations.
Rectification And ErasureGreen
Rights to correction, addition or deletion of retained personal data exist; erasure/cessation-of-use rights were expanded by the 2020/2022 amendment beyond the original narrow trigger conditions.
Claims (2):
- Data subjects may demand correction, addition or deletion of the content of retained personal data.
- The 2020/2022 amendment expanded data subjects' rights to demand cessation of use, deletion, or cessation of third-party provision of retained personal data to cases where a data subject's rights or legitimate interests are likely to be infringed, beyond the prior narrow grounds of purpose-violation, improper collection, or unlawful third-party provision.
Restriction And ObjectionGreen
Cessation of use/third-party provision functions as the APPI's restriction/objection mechanism, now exercisable wherever rights or legitimate interests are likely to be infringed.
Claims (1):
- The 2020/2022 amendment expanded data subjects' rights to demand cessation of use, deletion, or cessation of third-party provision of retained personal data to cases where a data subject's rights or legitimate interests are likely to be infringed, beyond the prior narrow grounds of purpose-violation, improper collection, or unlawful third-party provision.
Data PortabilityAmber
No explicit portability right analogous to GDPR Art 20 exists; the amendment's electronic-disclosure entitlement is the closest functional equivalent.
Claims (2):
- The 2020/2022 amendment allows data subjects to require that their retained personal data be disclosed to them electronically, whereas the prior law did not expressly permit electronic-format disclosure demands.
- The APPI does not contain a distinct data-portability right equivalent to GDPR Article 20; electronic disclosure of retained personal data is the closest functional analogue.
Deadlines And Response WindowsAmber
The APPI imposes a 'without delay' response standard for disclosure requests rather than a fixed statutory number of days.
Claims (1):
- A business operator must disclose retained personal data to a data subject without delay, subject to statutory exceptions such as risk of harm to life or improper interference with business operations.
Data Subject Rights
The amendment package produces a mixed picture for data-subject rights. It grants children enhanced deletion and suspension rights alongside a new parental-consent requirement for processing the data of individuals under 16. It also relaxes breach-notification obligations owed to affected individuals: where risk is assessed as low, notification to the individual can be replaced with alternative measures, moving away from the current threshold-based mandatory-notification model.
Outlook
Neither change is yet operative. Once commenced, the relaxed breach-notification default will need to be read alongside the PPC's separate, currently in-force Article 26 reporting-to-PPC obligations, which are unaffected by this particular provision and continue under existing thresholds and online-submission procedures.
Sources and claims (6)
- ConfirmedPPC — Data subjects have the right to demand disclosure of retained personal data held by a business operator.observed
- ConfirmedPPC — A business operator must disclose retained personal data to a data subject without delay, subject to statutory exceptions such as risk of harm to life or improper interference with business operations.observed
- ConfirmedIAPP — Data subjects may demand correction, addition or deletion of the content of retained personal data.observed
- ConfirmedIAPP — The 2020/2022 amendment expanded data subjects' rights to demand cessation of use, deletion, or cessation of third-party provision of retained personal data to cases where a data subject's rights or legitimate interests are likely to be infringed, beyond the prior narrow grounds of purpose-violation, improper collection, or unlawful third-party provision.observed
- ConfirmedIAPP — The 2020/2022 amendment allows data subjects to require that their retained personal data be disclosed to them electronically, whereas the prior law did not expressly permit electronic-format disclosure demands.observed
- ProbableIAPP — The APPI does not contain a distinct data-portability right equivalent to GDPR Article 20; electronic disclosure of retained personal data is the closest functional analogue.observed