Data Protection Act, 2013, notice and rights of data subjects

Data Protection Act, 2013, ss. 6, 11-16 (notice and rights of data subjects)

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force.

A data subject rights rule binding public and private bodies.

As of 19 September 2026.

What it requires

Tell a data subject, on request, the purposes of collecting and processing their personal data, its source if known, the classes of third parties it may be disclosed to, whether supplying it is obligatory or voluntary and the consequences of not supplying it, and how to contact you with inquiries or complaints.
Give a data subject access to their personal data within thirty days of a written and paid request, disclosing the data itself, the purposes of processing, the classes of recipients and the data's source, subject to a permitted extension of up to thirty further days or a longer period to convert the data into an alternative format for a data subject with a sensory disability.
Where you deny an access request, state the specific statutory ground in the refusal notice, tell the data subject of the right to complain to the Information Commissioner, and treat a failure to respond within the time limits as a deemed refusal.
Correct personal data on a data subject's written application where it is incomplete, incorrect, misleading, excessive or irrelevant to the purpose it is held for, without obliterating the pre-amendment text of the document, or give written reasons for refusing and tell the data subject of the right to complain to the Information Commissioner within twenty-eight days.

What it reaches

Obligation class

Data subject rights, Disclosure, Access restriction

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Section 6 requires a data user, on a data subject's request, to disclose the purposes for which their personal data is being or will be collected and processed, any information available about its source, the classes of third parties it may be disclosed to, whether supplying the data is obligatory or voluntary and the consequences of not supplying it, and how to contact the data user with inquiries or complaints.

Section 11 gives a data subject the right to access their personal data held by a data user and to have it corrected where it is inaccurate, incomplete, misleading or not up to date, except where access or correction is refused under this Act.

Section 12 requires a public body or private body, on a person's written request and payment of the prescribed fee, to say whether personal data of which that person is the data subject is being processed and, if so, to communicate the data itself, the purposes of processing, the classes of recipients and the source of the data.

Section 13 requires the body to give written notice within thirty days of the request whether access will be granted and, if so, to give access, subject to an extension of up to thirty further days or a longer period needed to convert the data into an alternative format.

Section 14 lets a body deny access where it lacks information to identify the requester or locate the data, where an exemption or duty of confidentiality applies, where a third party identifiable from the data withholds consent, or where the Information Commissioner approves the refusal in writing, and requires the Chief Executive Officer's refusal notice to state the specific statutory ground and the right to complain to the Information Commissioner.

Section 15 requires the body to let the data subject examine the personal data or give them a copy, in an alternative format where the data subject has a sensory disability and that format already exists or converting to it is reasonable.

Section 16 requires the body, on a data subject's written application specifying the claimed defect and the amendment requested, to correct personal data found to be incomplete, incorrect, misleading, excessive or irrelevant without obliterating the pre-amendment text, or to refuse with written reasons and tell the data subject of the right to complain to the Information Commissioner within twenty-eight days.

When LexLint raises it

crawls_web
trains_models
deploys_chatbot
automated_outreach

Read the law

Official Gazette text of the Data Protection Act, 2013, Government Printing Office, Antigua and Barbuda

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app