The right to obtain information
Every person has a right to control the processing of his/her personal data which can be exercised for instance by demanding to obtain information concerning the processing of his/her data.
On the grounds of Article 32 paragraph 1 points 1 to 5a the person has a right to demand - in connection to the processing of personal data - the following information.
In case where data is processed for scientific, didactic, historical, statistical or archival purposes the controller may decide not to notify the data subject about the processing of his/her personal data, if the provision of such information involves disproportionate efforts.
Article 33 of the Act on the Protection of Personal Data imposes the obligation on the controller to notify the data subject about the processing of his/her personal data. The data subject shall lodge a motion in writing in order to get the earlier mentioned information. The controller shell be obliged to notify the data subject within the period of 30 days. At the request of the data subject, the information shall be given in writing.
The controller shall be obliged to notify the data subject about his/her rights and give information - regarding the processing of personal data - referred to Article 32 paragraph 1 points 1 - 5a such as:
On the grounds of Article 32 paragraph 1 points 1 to 5a the person has a right to demand - in connection to the processing of personal data - the following information.
- whether such system exists,
- who is the controller,
- since when the personal data have been processed,
- what is the source of personal data,
- about the means in which the data are disclosed,
- about the prerequisites of taking the decision solely based on automated processing of personal data in a computer system (but only if the decision is taken in the course of entering into or performance of a contract and the request lodged by the data subject has been satisfied),
- informing in the universally understandable way about the data processing.
In case where data is processed for scientific, didactic, historical, statistical or archival purposes the controller may decide not to notify the data subject about the processing of his/her personal data, if the provision of such information involves disproportionate efforts.
Article 33 of the Act on the Protection of Personal Data imposes the obligation on the controller to notify the data subject about the processing of his/her personal data. The data subject shall lodge a motion in writing in order to get the earlier mentioned information. The controller shell be obliged to notify the data subject within the period of 30 days. At the request of the data subject, the information shall be given in writing.
The controller shall be obliged to notify the data subject about his/her rights and give information - regarding the processing of personal data - referred to Article 32 paragraph 1 points 1 - 5a such as:
- whether such system exists,
- who is the data controller (the address of the controller's seat and its full name, and in case the controller is a natural person - his/her address and his/her full name),
- since when his/her personal data have been processed,
- what is the source of his/her personal data (unless the controller is obliged to keep it confidential as a state, trade or professional secrecy),
- information about the means by which the data are disclosed (in particular about the recipients or categories of recipients of the data),
- information about the prerequisites of taking the decision exclusively as a result of the operations on personal data conducted in the information system,
- informing in the universally understandable way about the data processing.
- the category of personal data contained in the file,
- the means of data collection,
- the purpose and the scope of data processing,
- the recipients of the data and the scope of access they have been granted.
- the disclosure of the information constituting a state secrecy,
- pose a threat to national defence or security of the state, human life and health, or security and public order,
- pose a threat to fundamental economic or financial interests of the state,
- substantial breach of personal interests of the data subjects or other persons.


