CHAPTER V
INFORMATION ON THE RIGHTS OF THE DATA SUBJECT

12. A brief summary of the data subject’s rights:

• Transparent information, communication and facilitating the exercise of rights by data subjects
• Right to be informed in advance – where personal data is collected from the data subject
• Informing the data subject and the information to be provided to them where the data controller did not obtain the personal data directly from them
• The data subject’s right of access
• The right to rectification
• The right to erasure („the right to be forgotten”)
• The right to restrict processing
• The obligation to provide notice in relation to the rectification or erasure of personal data, or the restriction of processing
• The right to data portability
• The right to protest
• Automated decision-making in individual cases, including profiling
• Restrictions
• Informing the data subject of the data breach
• The right to lodge a complaint with the supervisory authority (the right to a remedy before the authority)
• The right to an effective judicial remedy against the supervisory authority
• The right to an effective judicial remedy against the data controller or data processor

13. The data subject’s rights in detail:

1. Transparent information and communication, and facilitating the exercise of data subjects’ rights

1.1. The data controller must provide the data subject with all information and notifications relating to the processing of personal data in a concise, transparent, intelligible and easily accessible form, using clear and plain language, particularly in the case of any information addressed to children. The information must be provided in writing or by other means, including, where appropriate, by electronic means. At the data subject’s request, information may also be provided orally, provided that the data subject’s identity has been verified by other means.

1.2. The data controller must facilitate the exercise of the data subject’s rights.

1.3. The data controller shall, without undue delay and in any event within one month of receipt of the request, inform the data subject of the measures taken in response to their request to exercise their rights. This time limit may be extended by a further two months under the conditions set out in the Regulation, of which the data subject must be informed.

1.4. If the data controller fails to take action in response to the data subject’s request, it shall, without delay, but no later than one month from receipt of the request, it shall inform the data subject of the reasons for failing to take action, and that the data subject may lodge a complaint with a supervisory authority and seek a judicial remedy.

1.5. The data controller shall provide the information and the information and measures relating to the data subject’s rights free of charge; however, a fee may be charged in the cases specified in the Regulation.

The detailed rules can be found in Article 12 of the Regulation.

2. Right to be informed in advance – where personal data is collected from the data subject

2.1. The data subject is entitled to be informed, prior to the commencement of data processing, of the facts and information relating to such processing. In this context, the data subject must be informed of:

• the identity and contact details of the data controller and their representative,
• the contact details of the data protection officer (if any),
• the purpose of the intended processing of personal data, and the legal basis for such processing,
• in the case of data processing based on the pursuit of a legitimate interest, the legitimate interests of the data controller or a third party,
• the recipients of the personal data – to whom the personal data is disclosed – and, where applicable, the categories of recipients;
• (e) where applicable, the fact that the data controller intends to transfer personal data to a third country or to an international organisation.

2.2. In order to ensure fair and transparent data processing, the data controller must provide the data subject with the following additional information:

• the period for which personal data will be stored, or, where this is not possible, the criteria used to determine that period;
• the data subject’s right to request from the data controller access to, rectification of, erasure of or restriction of the processing of personal data relating to them, and to object to the processing of such personal data, as well as the data subject’s right to data portability;
• in the case of data processing based on the data subject’s consent, that they have the right to withdraw their consent at any time, without this affecting the lawfulness of the data processing carried out on the basis of that consent prior to the withdrawal;
• the right to lodge a complaint with the supervisory authority;
• whether the provision of personal data is required by law or under a contractual obligation, or whether it is a prerequisite for entering into a contract, and whether the data subject is obliged to provide the personal data, as well as the possible consequences of failing to provide such data;
• the fact that automated decision-making, including profiling, is taking place, as well as, at least in such cases, the logic applied and comprehensible information as to the significance of such data processing and the likely consequences for the data subject.

2.3. Where the data controller intends to carry out further processing of personal data for a purpose other than that for which the data were collected, the data controller must inform the data subject of that different purpose and provide any relevant additional information prior to carrying out such further processing.

The detailed rules governing the right to prior information are set out in Article 13 of the Regulation.

3. Informing the data subject and the information to be provided to them where the data controller has not obtained the personal data directly from them

3.1. Where the data controller has not obtained the personal data from the data subject, the data controller shall inform the data subject no later than one month after obtaining the personal data; where the personal data are used for the purpose of communicating with the data subject, at the very least at the time of the first contact with the data subject; or if the data are likely to be disclosed to other recipients, no later than the first time the personal data are disclosed, the data controller must inform the data subject of the facts and information set out in point 2 above, as well as the categories of personal data relating to the data subject, the source of the personal data and, where applicable, whether the data are derived from publicly available sources.

3.2. Further rules are governed by the provisions set out in point 2 above (Right to prior information).

The detailed rules governing this information are set out in Article 14 of the Regulation.

4. The data subject’s right of access

4.1. The data subject has the right to receive confirmation from the data controller as to whether their personal data is being processed and, if such processing is taking place, has the right to access their personal data and any related information. (Article 15 of the Regulation).

4.2. Where personal data are transferred to a third country or to an international organisation, the data subject has the right to be informed of the appropriate safeguards relating to the transfer in accordance with Article 46 of the Regulation.

4.3. The data controller must provide the data subject with a copy of the personal data being processed. The data controller may charge a reasonable fee, based on administrative costs, for any further copies requested by the data subject.

Detailed rules concerning the data subject’s right of access are set out in Article 15 of the Decree.

5. The right to rectification

5.1. The data subject has the right to have the Data Controller rectify any inaccurate personal data concerning them without undue delay upon request.

5.2. Taking into account the purpose of the data processing, the data subject is entitled to request that incomplete personal data be supplemented, including, amongst other things, by means of a supplementary statement.

These rules are set out in Article 16 of the Regulation.

6. The right to erasure („the right to be forgotten”)

6.1. The data subject has the right to request that the data controller erase personal data relating to them without undue delay, and the data controller is obliged to erase personal data relating to the data subject without undue delay if

• the personal data are no longer necessary for the purpose for which they were collected or otherwise processed;
• the data subject withdraws their consent, which forms the basis for the data processing, and there is no other legal basis for the data processing;
• the data subject objects to the processing of their data, and there are no legitimate grounds for the processing that take precedence,
• personal data was processed unlawfully;
• personal data must be erased in order to comply with a legal obligation under Union or Member State law applicable to the data controller;
• The collection of personal data took place in connection with the provision of information society services offered directly to children.

6.2. The right to erasure may not be exercised where the processing is necessary

• for the purpose of exercising the freedom of expression and the right to information;
• for the purposes of compliance with a legal obligation under EU or Member State law to which the data controller is subject, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller;
• on the grounds of public interest relating to the field of public health;
• for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes, in so far as the right to erasure is likely to render such processing impossible or seriously jeopardise it; or
• to bring, enforce and defend legal claims.

The detailed rules on the right to erasure are set out in Article 17 of the Regulation.

7. The right to restriction of processing

7.1. Where data processing is restricted, such personal data may, apart from storage, only be processed with the data subject’s consent, or for the purpose of establishing, enforce or defend legal claims, or to protect the rights of another natural or legal person, or for reasons of substantial public interest of the Union or of a Member State.

7.2. The data subject has the right to request that the Data Controller restrict the processing of their data if any of the following conditions are met:

• the data subject disputes the accuracy of the personal data; in this case, the restriction shall apply for a period enabling the Data Controller to verify the accuracy of the personal data;
• the processing is unlawful, and the data subject objects to the erasure of the data and requests, instead, that its use be restricted;
• the Data Controller no longer requires the personal data for the purposes of data processing, but the data subject requires it for the establishment, exercise or defence of legal claims; or
• the data subject has objected to the processing; in this case, the restriction shall apply for as long as it has not been established whether the data controller’s legitimate grounds override those of the data subject.

7.3. The data subject must be informed in advance of the lifting of the restriction on data processing.

The relevant rules are set out in Article 18 of the Regulation.

8. The obligation to notify in relation to the rectification or erasure of personal data, or the restriction of processing

The data controller shall inform any recipient to whom the personal data have been disclosed of any rectification, erasure or restriction of processing, unless this proves impossible or involves a disproportionate effort. At the data subject’s request, the data controller shall provide information about these recipients.

These rules are set out in Article 19 of the Regulation.

9. The right to data portability

9.1. Subject to the conditions set out in the Regulation, the data subject is entitled to receive the personal data concerning them, which they have provided to a data controller, in a structured, commonly used and machine-readable format, and is also entitled to transmit those data to another data controller without hindrance from the data controller to whom the personal data were provided, provided that

• the processing of personal data is based on consent or a contract; and
• Data processing is carried out automatically.

9.2. The data subject may also request the direct transfer of personal data between data controllers.

9.3. The exercise of the right to data portability must not infringe Article 17 of the Regulation (The right to erasure („the right to be forgotten”)). The right to data portability shall not apply where the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. This right shall not adversely affect the rights and freedoms of others.

The detailed rules are set out in Article 20 of the Regulation.

10. The right to protest

10.1. The data subject has the right to object at any time, on grounds relating to their particular situation, to the processing of their personal data carried out in the public interest or in the performance of a public task (Article 6 (1) ) or a legitimate interest (Article 6(f))—including profiling based on those provisions. In such a case, the data controller may no longer process the personal data unless the data controller demonstrates that the processing is justified by compelling legitimate grounds which override the data subject’s interests, rights and freedoms, or which relate to the establishment, exercise or defence of legal claims.

10.2. Where personal data are processed for the purposes of direct marketing, the data subject has the right to object at any time to the processing of personal data relating to them for this purpose, including profiling, insofar as it is related to direct marketing. If the data subject objects to the processing of personal data for the purposes of direct marketing, the personal data may no longer be processed for that purpose.

10.3. The data subject must be expressly informed of these rights at the latest when first contacted, and the relevant information must be presented clearly and separately from all other information.

10.4. The data subject may also exercise their right to object using automated means based on technical specifications.

10.5. Where personal data are processed for scientific or historical research purposes or for statistical purposes, the data subject shall have the right to object, on grounds relating to their particular situation, to the processing of personal data concerning them, unless the processing is necessary for the performance of a task carried out in the public interest.

The relevant rules are set out in the article of the Regulation.

11. Automated decision-making in individual cases, including profiling

11.1. The data subject has the right not to be subject to a decision based solely on automated processing – including profiling – which produces legal effects concerning him or her or similarly significantly affects him or her.

11.2. This right shall not apply where the decision:

• is necessary for the conclusion or performance of a contract between the data subject and the data controller;
• the processing is permitted by Union or Member State law applicable to the data controller, which also lays down appropriate safeguards to protect the data subject’s rights and freedoms and legitimate interests; or
• is based on the data subject’s explicit consent.

11.3. In the cases referred to in points (a) and (c) above, the data controller shall take appropriate measures to safeguard the data subject’s rights, freedoms and legitimate interests, including, at a minimum, the data subject’s right to request human intervention on the part of the data controller, to express their views, and to lodge an objection to the decision.

Further rules are set out in Article 22 of the Regulation.

12. Restrictions

EU or Member State law applicable to the data controller or data processor may, by means of legislative measures, restrict the scope of rights and obligations (Articles 12–22, Article 34, Article 5) where the restriction respects the essence of fundamental rights and freedoms.

The conditions for this restriction are set out in Article 23 of the Regulation.

13. Informing the data subject of the data breach

13.1. Where a data breach is likely to result in a high risk to the rights and freedoms of natural persons, the data controller must inform the data subject of the data breach without undue delay. This notification must describe the nature of the data breach in a clear and plain language and must include at least the following:

• the name and contact details of the data protection officer or any other contact person who can provide further information;
• the likely consequences of the data breach must be set out;
• The measures taken or planned by the data controller to remedy the data breach must be described, including, where appropriate, measures aimed at mitigating any adverse consequences arising from the data breach.

13.2. The data subject need not be informed if any of the following conditions are met:

• the data controller has implemented appropriate technical and organisational security measures, and these measures were applied to the data affected by the data breach, in particular those measures – such as the use of encryption – which render the data unintelligible to any person not authorised to access the personal data;
• following the data breach, the data controller has taken further measures to ensure that the high risk to the data subject’s rights and freedoms is unlikely to materialise in the future;
• providing such information would require a disproportionate effort. In such cases, the data subjects must be informed by means of publicly available information, or similar measures must be taken to ensure that the data subjects are informed in an equally effective manner.

Further provisions are set out in Article 34 of the Regulation.

14. The right to lodge a complaint with the supervisory authority (the right to a remedy before the supervisory authority)

The data subject has the right to lodge a complaint with a supervisory authority – in particular in the Member State of their habitual residence, their place of work or the Member State in which the alleged infringement took place – if the data subject considers that the processing of personal data relating to them infringes the Regulation. The supervisory authority to which the complaint has been lodged is obliged to inform the data subject of the progress of the proceedings relating to the complaint and of their outcome, including the fact that the data subject has the right to seek judicial redress.

These rules are set out in Article 77 of the Regulation.

15. The right to an effective judicial remedy against the supervisory authority

15.1. Without prejudice to other administrative or non-judicial remedies, every natural and legal person is entitled to an effective judicial remedy against a legally binding decision of the supervisory authority concerning them.

15.2. Without prejudice to other administrative or non-judicial remedies, every data subject shall have the right to an effective judicial remedy if the competent supervisory authority fails to deal with the complaint or fails to inform the data subject within three months of the progress or outcome of the proceedings relating to the complaint lodged.

15.3. Proceedings against the supervisory authority must be brought before the courts of the Member State in which the supervisory authority has its seat.

15.4. Where proceedings are brought against a decision of a supervisory authority in respect of which the Board has previously issued an opinion or taken a decision within the framework of the Single Supervisory Mechanism, the supervisory authority shall be obliged to forward that opinion or decision to the court.

These rules are set out in Article 78 of the Regulation.

16. The right to an effective judicial remedy against the data controller or data processor

16.1. Without prejudice to the administrative or non-judicial remedies available – including the right to lodge a complaint with the supervisory authority – every data subject shall have the right to an effective judicial remedy if they consider that their rights under this Regulation have been infringed as a result of the processing of their personal data in a manner that does not comply with this Regulation.

16.2. Proceedings against the data controller or the data processor must be brought before the courts of the Member State in which the data controller or the data processor has its place of business. Such proceedings may also be brought before the courts of the Member State in which the data subject has his or her habitual residence, unless the controller or processor is a public authority of a Member State acting in the exercise of its public powers.

These rules are set out in Article 79 of the Regulation.

Dated 31 August 2026, Budapest.