Data Protection Act, 2024, rights of data subjects

Data Protection Act, 2024 (Act No. 18 of 2024), Part VIII (ss. 37-49)

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force since 14 January 2025.

A data subject rights rule binding public and private bodies.

As of 19 September 2026.

What it requires

Provide a data subject, on request, with confirmation of whether their personal data is being processed, and where it is, access to it and to information on the purpose of processing, the categories of data, the recipients, the retention period, and the existence of automated decision-making, including profiling.
Act on a data subject's request to rectify, erase, restrict the processing of, port, or object to the processing of their personal data, and inform the data subject of the outcome without undue delay and, in any event, within one month of receipt of the request, extendable by up to two further months with the Commission's approval.
Do not base a decision that produces legal effects concerning a person, or significantly affects them, solely on automated processing, including profiling, unless a listed exception applies, and where one does, let the person obtain human intervention, express their point of view, and contest the decision.

What it reaches

Obligation class

Data subject rights

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

A data subject has the right to obtain confirmation of whether their personal data is being processed and, where it is, access to it together with information on the purpose of processing, the categories of data, the recipients, the retention period, and the existence of automated decision-making, including profiling.

A data controller must act on a data subject's request to rectify, erase, restrict the processing of, port, or object to the processing of their personal data, and must inform the data subject of the outcome without undue delay and, in any event, within one month of receipt of the request, extendable by up to two further months with the Commission's approval.

Section 49 gives a data subject the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects concerning them or significantly affects them, subject to listed exceptions, and where an exception applies the controller must let the data subject obtain human intervention, express their point of view, and contest the decision.

When LexLint raises it

high_risk_decisions
crawls_web
trains_models
deploys_chatbot
automated_outreach

Read the law

Data Protection Act
2024, Government Gazette Extraordinary Vol. LXII, No. 144 of 29 October 2024, reproduced by dpo-india.com, with the commencement day from the Botswana Laws bulletin entry for the Act

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app