Agencia española de protección de datos

Exercise of rights

The rights of access, rectification, cancellation and opposition (ARC rights) are recognized in the organic law of data protection and allow know what personal information our is being examined by a manager (without access to documents), who or where to have obtained such data and to whom they have been assigned. They also modify or correct errors, cancel data that is not should be searching or oppose treatment of personal data made without our consent.

To exercise them, it is important to know a number of aspects, which are available in more detail in the Guide to the citizen the AEPD:

  • Must be exercised directly by the person concerned to each of those responsible / holders of the files. If it acts on behalf of another person is necessary to prove that we have been authorized to represent them.
  • The law states that to exercise these rights it is imperative that the citizen is directed first to the entity that is trying their data using any means that allows certifying the sending and receiving the application. If the entity does not respond to the request made by the deadline by law or the citizen finds the reply that receives is wrong, you may request that the Spanish Agency of data protection supervise their right opposite the responsible.
  • Rights are independent, so it is not necessary to exercise firstly the right of access to rectify or cancel.
  • The exercise of these rights must be simple, free and cannot assume any additional income for the responsible, which must facilitate a procedure for the exercise of rights. It is advisable to use this procedure, while the responsible cannot ignore an application, duly submitted, use other means.
  • The content of the application must include: the name and surname of the person; photocopy of their national identity card, passport or other valid document that identifies and, if necessary, of the person to represent him, as well as the document or electronic instrument certifying that representation; detail of the call; e for notification purposes; date and signing of the applicant; and documents supporting the request made if necessary.
  • The person responsible must comply with the request even when there is no personal data of the applicant, as well as ensuring that your organization is able to inform about how to exercise the rights.

If you wish to file a complaint to the agency to this supervise your rights against the responsible after completing the previous points, electronic headquarters of the agency offers you several options to request it.