🇳🇮Law No. 787 on Protection of Personal Data
Law No. 787 on Protection of Personal Data
Law 787 regulates public and private personal-data files and protects access, correction, blocking, deletion, opposition and informational self-determination. Decree 36-2012 supplies detailed rules for consent, notices, security measures, rights requests, inspection and enforcement.
Core controller duties
A controller must define a legitimate purpose, collect proportionate and necessary data, obtain and prove consent unless an exception applies, give the statutory notice, register each file and keep the registration current. Security measures must address confidentiality, integrity and unauthorised access, disclosure or transfer, and are subject to DIPRODAP approval.
Rights and deadlines
Access information is due within ten business days. Supported correction, modification, blocking, deletion or cancellation must be completed within five business days, and an approved change must be communicated to a recipient within a further five business days. The regulation provides a one-time cure process for incomplete requests.
Transfers and specialised processing
Transfers require an authorised request, stated purpose, safeguards, consent or a statutory exception, onward-transfer controls and notice to DIPRODAP. The law also contains specific rules for advertising files, surveys, digital forgetting and sensitive information.