1. Rights of personal data subject matters:

a) To be informed of the personal data processing;

b) To consent, refuse, or request withdrawal of consent to the personal data processing;

c) To view, modify, or request modification of their personal data;

d) To request provision, deletion, and restriction of personal data processing; to object to personal data processing;

dd) To complain, denounce, initiate lawsuits, or claim damages according to the law;

e) To request competent authorities or agencies, organizations, or individuals relevant to personal data processing to adopt solutions and measures to protect their personal data according to the law.

2. Obligations of personal data subject matters:

a) To protect their personal data;

b) To respect and protect the personal data of others;

c) To adequately and accurately provide their personal data according to the law, contracts, or upon their consent to the processing of their personal data;

d) To comply with personal data protection laws and participate in the prevention and combat against personal data infringement.

3. Personal data subject matters shall, when exercising their rights and fulfilling their obligations, ensure compliance with the following principles:

a) Ensuring compliance with the law and contractual obligations; ensuring that the rights and obligations of personal data subject matters are implemented to protect the legitimate rights and benefits of such subject matters;

b) Refraining from obstructing or hindering the implementation of legal rights and obligations of the personal data controlling parties, personal data processing and controlling parties, and personal data processing parties;

c) Refraining from infringing on the legitimate rights and benefits of the State and other agencies, organizations, and individuals.

a) To protect the life, health, honor, dignity, and legitimate rights and benefits of the personal data subject matter or others in urgent cases; or to protect one’s own or others’ legitimate rights or benefits, or benefits of the State or agencies/organizations in a necessary manner against infringement on such rights or benefits. The personal data controlling party, personal data processing party, personal data processing and controlling party, and the third party shall prove the necessity of such processing;

b) To respond to emergencies or threats to national security that have yet to escalate to the level of a declared emergency; to prevent and combat riots, terrorism, crimes, and law violations;

c) To serve the operations of state agencies and the state management according to the law;

d) To carry out the agreement between the personal data subject matter and a relevant agency, organization, or individual according to the law;

dd) Other cases according to the law.

1. Consent of a personal data subject matter (hereinafter referred to as “consent”) refers to when the personal data subject matter permits the processing of its personal data unless otherwise prescribed by the law.

2. The consent is valid only if it is voluntary and based on full awareness of the following information:

a) The type of personal data to be processed and the purpose of the processing;

b) The personal data controlling party or the personal data processing and controlling party;

c) Rights and obligations of the personal data subject matter.

3. The consent shall be displayed in a clear and specific manner, in a format that can be printed or copied in writing, including electronic forms or verifiable formats.

4. The consent shall comply with the following principles:

a) The consent must be specific to each purpose;

b) Conditions requiring consent for purposes other than those stated in the agreement must not be enclosed;

c) The consent shall be valid until the personal data subject matter changes it or as prescribed by the law;

d) Silence or lack of response shall not be deemed as consent.