The Personal Data Protection Authority said replying to data subjects' applications only through verbal communication does not comply with the law, adding that responses must be notified in writing or electronically.
In its public announcement, the authority recalled that data controllers must conclude applications within 30 days at the latest, stressing that a phone call or face-to-face briefing cannot replace the official response.