What to account for
Inform people before collecting data
Article 6 requires clear prior information on purposes, recipients, the responsible party and address, mandatory or optional answers, consequences and access, correction and deletion rights.
Prepare the rights-response process
AAIP states a 10-calendar-day response period for access requests and five business days for correction, updating or deletion requests. Build an inbox and workflow that can meet the applicable period.
Check the destination of overseas transfers
AAIP instructs exporters to check whether the destination is recognized as adequate. For other destinations, assess an applicable safeguard or exception, including approved contractual mechanisms where relevant.
Common mistakes to check
Copying GDPR bases without checking local law
Article 5 sets consent requirements and specific exceptions. Do not assume that a GDPR label automatically supplies the basis for processing under Law 25.326.
Publishing a contact that nobody monitors
AAIP’s rights guidance provides response deadlines and a complaint route. A policy link alone does not handle requests; assign responsibility for the actual response.
Your review checklist
Our suggested review process. The linked requirements above explain the platform or legal basis.
Inventory forms and recipients
Scan the website and inspect account, contact and payment flows. Record each field, its purpose, whether it is required, and the systems or providers that receive it.
Confirm the local legal decisions
With the responsible reviewer, confirm consent or an applicable exception, retention, international transfers and any database-registration obligations relevant to the operation. Record the evidence for those decisions.
Publish and test the rights route
Review the draft, add controller and contact details, and link the notice at collection points and in the footer. Test a request end to end and record receipt and response dates.
Example
A local shop with overseas email hosting
A fictional shop collects delivery details and support enquiries. Its owner maps the checkout, courier, inbox and hosting provider, including countries where data are processed.
From inventory to a working policy
The reviewer confirms the local basis and transfer route. The owner reviews the draft, links it beside forms and tests how an access or correction request reaches each relevant tool.
Questions before publishing
How quickly must an access request be answered?
AAIP specifies ten calendar days. Correction, updating and deletion requests have a five-business-day period.
Can I use a provider in another country?
Assess the destination and applicable transfer mechanism. AAIP publishes adequacy information and model contractual options; the provider’s location should be part of your review.
Is consent always the required route?
Article 5 includes exceptions, such as certain processing necessary for a contractual relationship. Check the exact facts against the applicable provision.
Source review and changes
First edition: platform requirements, implementation checks and fictional worked example. Sources reviewed on the date above; verify changes before relying on them.