950 CMR, § 33.21
Current through Register 1536, December 6, 2024
An agency shall, within 20 days of receipt of a request, grant access to any data subject, to any personal data concerning him which is held by the agency in an indexed personal data system, except where such access is prohibited by statute. In addition, such data subject shall have the right to inspect and to copy any personal data to which he has access, subject to appropriate supervision. Access to personal data which is not held in an indexed personal data system and which is not prohibited by statute shall be granted by an agency to a data subject if such data subject is able to supply sufficient information to the agency to enable it to retrieve such personal data in the ordinary course.
950 CMR, § 33.21