Without prejudice to other relevant Laws, the data subject may, in writing or electronically, request from the data controller or the data processor the following:

1. to provide him or her with the information relating to the purposes of the processing of personal data;
2. to provide him or her with a copy of personal data;
3. to provide him or her with a description of personal data that the data controller or the data processor holds, including data on the contact details of a third party or the categories of third parties who have or had access to personal data;
4. to inform him or her of the source of the personal data in case his or her personal data have not been obtained from the data subject;
5. to inform him or her in case his or her personal data have been transferred to a third country or to an international organisation.

The right referred to in Item 2° of Paragraph One of this Article is not exercised if:

1. it may adversely affect the rights and freedoms of other persons;
2. legal professional privilege or another legal obligation of confidentiality applies;
3. the data relates to information management or information about the data subject or relates to ongoing negotiations with the data subject requester;
4. the data relates to the data subject’s confidential references, examination scripts or examination marks.

The data controller or the data processor must provide the data subject with his or her personal data in a clear and concise manner.

The data subject who is not satisfied with the response of the data controller or the data processor may appeal to the supervisory authority within thirty (30) days from the date of receipt of the response.

If the data subject appeals, the supervisory authority responds to his or her appeal within sixty (60) days from the date of receipt of the appeal.