Page 1

Rights of the data subject
Published: 23.10.2020.

The National Data Inspectorate shall report that, in accordance with Article 12, Paragraph three of the General Data Protection Regulation (hereinafter - the Regulation)
the controller (hereinafter - the organization) without undue delay and in any case within one month upon request
the data subject shall be informed of the action taken on request in accordance with Articles 15 to 22 of the Regulation .

You have the right to contact the organization
You have the right to access your personal data (Article 15 of the Regulation)

If the organization processes your personal data, then you have the right to request access to all your personal data, including
receive copies of your personal data in the format of your choice.

Correction of inaccurate personal data (Article 16 of the Regulation)

If you notice that the organization has inaccurate information that contains your personal data, then you have the right and the organization has
the obligation to correct inaccurate data without undue delay.

The right to be "forgotten" (Article 17 of the Regulation )

If the organization processes your personal data, then, in accordance with the cases set out in the Regulation, you have the right and the organization has
obligation to delete your personal data without undue delay.

Restrict the processing of your personal data (Article 18 of the Regulation)

You have the right to have your personal data restricted if:
Dispute that your personal data is accurate at the disposal of the organization;
The processing of your personal data is illegal;
The organization does not need your personal data, but you know that it is necessary for you to implement your own or defend your
legal requirements;
if your right to data protection takes precedence over the legitimate interests of the organization.
Receive information on the rectification or erasure of your data or the restriction of processing (Article 19 of the Regulation )

The organization is obliged to report if your personal data has been disclosed to third parties, personal data have been corrected, deleted or
your personal data processing has been restricted.

The right to receive your data "back" or to "transfer" your personal data to another organization (Article 20 )

If the organization processes your personal data on the basis of your prior consent or between the organization and you
contractual obligations, you have the right to request that the organization “return” your personal data or “transfer” it to another
organization.

Page 2
The right to object to the processing of data if your right to data protection is more important than the legitimate interests of the organization (Article 21 )

If the organization processes your personal data, then when assessing your right to data protection, you have the right to object to your own
processing of personal data.

! Remember that the organization must prove that the organisation's legitimate interests outweigh your rights to personal data
processing.

!! If your personal data is processed for direct marketing purposes, then you have the right to object to your personal data at any time
processing, including requesting the deletion of your personal data from the organization’s database.

The right to object to automated processing of personal data, including profiling (Article 22 of the Regulation )

Unless automated processing of personal data is permitted by a specific legal act, you have the right to express your views in an automated manner.
in the case of decision-making. The organization must take appropriate measures to protect your rights and freedoms, and
legitimate interests.

What documents must be submitted?
In exercising their rights, the Data State Inspectorate recommends applying to the organization by submitting an official application .

In order for a document to have legal force, in accordance with Section 4, Paragraph one of the Law on Legal Validity of Documents, a document shall be included therein
the name of the author, the date of the document and the signature. In accordance with Section 3, Paragraph one of the Electronic Documents Law, the requirement for
the written form of the document in relation to the electronic document is completed if the electronic document has an electronic
the signature and the electronic document comply with other requirements specified in regulatory enactments.

! In the event of a dispute, a formal submission will serve as proof that I have exercised my rights under the Regulation but the organization is not complying.
Obligations under the Regulation.

Sample data subject information request

Action by the organization if requested
The organization shall, within one month of receiving the request, inform you of the action taken on the request in accordance with
Articles 15 to 22 of the Regulation.

If necessary, that period may be extended by a further two months, taking into account the complexity and number of requests.
The controller shall inform the data subject of any such extension and the reasons for the delay within one month of the request
receipt.

If the data subject submits the request in electronic form, the information shall, where possible, be provided in electronic form, unless the data
the entity requests otherwise.

Data State Inspectorate
If the organization does not fulfill the obligations set out in the Regulation, then you have the right to apply to the Data State Inspectorate by writing a formal application,
on " Complaint about the processing of personal data ". Information and a sample application are available at https://www.dvi.gov.lv/lv/iesniegumu-

Page 3
examples

When reviewing the received application (complaint), the Data State Inspectorate shall, within the scope of its competence, initiate an inspection if it is established
a breach of the processing of personal data in accordance with the requirements set out in the Regulation and if the person (data subject) has used them
The right of recourse to the controller provided for in the Regulation (Articles 15-22) [1].

Thus, the Data State Inspectorate reminds you that you have the right to apply in writing to the controller using your Regulation (Articles 15-22).
specified rights.

[1] In the event of non-compliance by the controller with the obligations laid down in the Regulation, the data subject has the right under Article 77 of the Regulation to
challenge the action before the supervisory authority (Data State Inspectorate), attaching documents certifying that the controller refuses to comply or
does not fulfill its obligations under the law. In such a case, the Data State Inspectorate in accordance with Article 57 (1) “f” of the Regulation
is obliged to deal with the complaint and to exercise the rights set out in the Regulation. Please be informed that each case should be evaluated
individually.

https://www.dvi.gov.lv/lv/datu-subjekta-tiesibas

