Insight into the collections of personal data

The citizen has the right to know what personal data is collected, processed and stored about him in paper or electronic form. For this purpose, he may make an inquiry into the collection of personal data with the controller that performs the processing of his personal data (Article 12 from the Law on Personal Data Protection). For example, the right to inspect in: medical records in a health facility where you are treated, the employee file in the legal entity where you work, the credit record in the financial institution where you are a credit user, the record of a telecommunications operator whose service you use etc).

To accomplish this right, you need to submit a written request to the controller that you think processes your personal data and where you will specify in detail the data that you want to know about.

The controller has a deadline of 30 days after the submission of the written request to notify you about:

  1. Whether and what personal data is processed;
  2. The purposes and legal basis for the processing of personal data;
  3. The purpose and legal basis on which your personal data has been given to other users;
  4. The source of personal data, when the data was collected and updated; and
  5. Reasons for automatic processing of data.

If you re-submit the same or similar request for access to your personal data and no change has occurred in the meantime, the controller (the authority) is not obliged to answer.

There is an exception to this rule when more than six months have passed since the day of submitting the previous request.

Also, when personal data is processed solely for scientific research or statistical purposes, the controller is not obliged to act on the request.