Article 22. The procedure for the provision of information regarding the processing of personal data

The subject has the right to receive information regarding the processing of his personal data containing:

confirmation of the fact of processing of personal data;

grounds and purposes of processing of personal data;

applicable methods of processing of personal data;

the name of the owner and (or) operator and their location (mailing address), information about persons who have access to personal data or who may be disclosed personal data on the basis of an agreement concluded with the owner and (or) operator, or based on law;

the composition of the processed personal data relating to the relevant subject, the source of their receipt, unless otherwise provided by this Law;

terms for processing of personal data, including periods for their storage;

the procedure for the exercise by the subject of the rights provided for in Article 30 of this Law;

information about the carried out or alleged cross-border transfer of personal data.

The subject's right to receive information regarding the processing of his personal data may be limited in cases where the provision of such information violates the rights and legitimate interests of others.

The procedure for the provision of information regarding the processing of personal data of a subject to a third party is determined by the conditions of consent of the subject to the processing of personal data.

The owner and (or) operator are exempted from the obligation to provide information to the subject regarding the processing of his personal data, in cases where:

the subject was previously notified of the processing of his personal data;

personal data is made public by the subject or obtained from a public source;

the provision of such information will violate the rights and legitimate interests of individuals and legal entities.

A notice of refusal to provide of information regarding the processing of personal data is sent to the submitting subject in writing within ten days.

A decision to refuse to provide of information regarding the processing of personal data may be appealed by the subject to the authorized state body or court.