What does UU 27/2022 (PDP Law) regulate regarding personal data subject rights?

Law Number 27 of 2022 on Personal Data Protection (UU 27/2022) sets out the rights of personal data subjects. Individuals to whom personal data relates (Article 1 point 6)—across Articles 5 through 13. An entity that determines the purpose and exercises control over processing, such as a clinic, hospital. Alternatively, Employer, is a Personal Data Controller (Article 1 point 4). Controllers must respond to data subject requests within statutory deadlines, subject to specific legal exceptions.

Nine data subject rights (Articles 5–13)

• Article 5 (Information): To receive clear information on identity, legal basis, purpose of collection and use, and accountability of the requesting party.
• Article 6 (Correction): To complete, update, and/or correct errors or inaccuracies in personal data.
• Article 7 (Access and copy): To obtain access to. Furthermore, A copy of personal data (free of charge except under specific conditions requiring a fee under the Elucidation of Article 7).
• Article 8 (Erasure): To end processing, delete, and/or destroy personal data in accordance with laws and regulations.
• Article 9 (Consent withdrawal): To withdraw previously given consent for personal data processing.
• Article 10 paragraph (1) (Objection to automated decisions): To object to decisions based solely on automated processing. This includes Health or behavioral profiling, that produce legal or significant effects.
• Article 11 (Restriction): To delay or restrict processing proportionally according to its purpose.
• Article 12 paragraph (1) (Damages): To sue for and receive compensation for violations of personal data processing.
• Article 13 (Portability): To obtain personal data in a commonly used machine-readable format and transmit it securely to another controller.

Submission rules, the 3 x 24-hour deadline, and exceptions

Rights under Articles 6 through 11 are exercised via a recorded electronic or non-electronic request to the controller (Article 14). Controllers must fulfill four request types within 3 x 24 hours (72 hours) of receipt: correcting data (Article 30), granting access. Furthermore, Processing logs (Article 32), stopping processing after consent withdrawal (Article 40 paragraph (2)), and delaying or restricting processing (Article 41 paragraph (1)).

Conversely, a controller must refuse access to alter data if doing so endangers the security or physical or mental health of the data subject or another person. Alternatively, Discloses another person's personal data (Article 33). Article 15 paragraph (1) also exempts several rights for national defense, law enforcement, public interest in state administration, financial sector supervision. Alternatively, Statutory scientific research and statistics. Furthermore, the right to erasure (Article 8. Article 43) must respect statutory retention rules such as medical record retention periods.

Violating these controller obligations carries administrative sanctions including written warnings, temporary suspension of processing. Data erasure, and/or fines of up to 2 percent of annual revenue against the violation variable (Article 57 paragraphs (1)–(3)).

Legal basis

• Law Number 27 of 2022 on Personal Data Protection (UU 27/2022): Article 1 points 4. Furthermore, 6, Article 4, Articles 5–15, Articles 20, 30, 32, 33, 34, 40, 41, 43. In addition, 57, together with the Elucidation of Article 7 and Article 10 paragraph (1).