Data Protection Act, No. 1 of 2023, rights of data subjects

Section 8 requires a data user, on request by a data subject, to tell the data subject the purposes and source of collecting and further processing their personal data, their right to request access and rectification, the classes of third party the data may be disclosed to, whether supplying the data is obligatory, and the consequences of not supplying it.

Section 13 gives a data subject the right to access personal data a data user holds about them and to have it rectified where it is inaccurate, incomplete, misleading or not up to date, except where access or rectification is refused under the Act.

Section 15 lets a person, on a written request and payment of a processing fee, require a public or private body to confirm whether it processes their personal data and, if so, to describe the data, the purposes of processing, the recipients or classes of recipient, and the source of the data.

Section 16 requires the body to give written notice within thirty days of whether access will be given and, if so, to give access within sixty days, subject to an extension of up to thirty more days in the circumstances section 16(2) lists.

Section 17 lets a data user refuse access where it cannot verify the requester's identity or locate the data, where an exemption under Part IV or a duty of confidentiality applies, where a third party identifiable from the data withholds consent to its disclosure, or where the Commission approves the refusal in writing, and requires the refusal notice to state the ground and the right to complain to the Commission.

Section 18 requires the body to let the data subject examine the data or give them a copy, in an alternative format where the data subject has a sensory disability and an alternative format already exists or conversion is reasonable.

Section 19 lets a data subject apply to have personal data amended where it is incomplete, incorrect, misleading, excessive or irrelevant to the purpose it is held for, and lets a data subject aggrieved by a refusal complain to the Commission within fifteen calendar days, though the section does not apply to records kept under the listed civil-registration and citizenship enactments.