Data Protection Act, 2018, rights of data subjects

Data Protection Act, 2018, ss. 13-18 (rights of data subjects)

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

Commencement not set.

A data subject rights rule binding public and private bodies.

As of 19 September 2026.

What it requires

This law was passed and gazetted in 2018 but, on its own terms, does not take effect until a Ministerial commencement order is published in the Gazette; no such order has been located, so whether it currently binds has to be confirmed before relying on what follows.
Give a data subject access to their personal data on request and payment of the prescribed fee, describing the data, the purposes of processing, the recipients, and the source of the data.
Give written notice of your access decision within thirty days of a data subject's request, or notify an extension of up to thirty days in the circumstances the Act lists, and tell the data subject of their right to complain to the Information Commissioner.
Refuse an access request only where you lack information to identify the requester or locate the data, compliance would breach an exemption or a duty of confidentiality, another identifiable individual has not consented to disclosure, or the Information Commissioner has not approved the refusal in writing.
Let a data subject examine their personal data or obtain a copy, and provide it in an alternative format where the data subject has a sensory disability and it is practicable to do so.
Correct personal data a data subject claims in writing is incomplete, incorrect, misleading, excessive, or irrelevant once satisfied of the claim, or tell the data subject of your refusal, your reasons, and their right to complain to the Information Commissioner within twenty eight days.

What it reaches

Obligation class

Data subject rights, Access restriction

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Section 13 gives a data subject the right to be given access to their personal data held by a data user and to have it corrected where inaccurate, incomplete, misleading or out of date, except where an access or correction request is refused under the Act.

Section 14 requires a public body or private body, on a data subject's written request and payment of the prescribed fee, to confirm whether it holds their personal data and, if so, to describe the data, the purposes of processing, the recipients, and the source of the data.

Section 15 requires the body to give written notice of its access decision within thirty days of the request, extendable by up to thirty days in the listed circumstances, and gives the data subject a right to complain to the Information Commissioner about an extension.

Section 16 lets a body refuse an access request only where it lacks information to identify the requester or locate the data, where compliance would breach a Part IV exemption or a duty of confidentiality, where another identifiable individual has not consented to disclosure, or where the Information Commissioner has not approved the refusal in writing, and gives the data subject a right to complain to the Information Commissioner about a refusal.

Section 17 lets the data subject examine the personal data or obtain a copy, and requires an alternative format for a data subject with a sensory disability where practicable.

Section 18 gives a data subject the right to apply in writing for rectification of personal data they claim is incomplete, incorrect, misleading, excessive, or irrelevant, requires the body to amend the data once satisfied of the claim, and gives a right to complain to the Information Commissioner within twenty eight days of a refusal.

When LexLint raises it

crawls_web
trains_models
deploys_chatbot
automated_outreach

Read the law

Data Protection Act, 2018 (No. 5 of 2018), Saint Kitts and Nevis Law Commission text, preserved on archive.org

archived copy

Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived July 25, 2024. Publisher's page: https://lawcommission.gov.kn/wp-content/documents/Annual-Laws/2018/ACTs/Act-5-of-2018-Data-Protection-Act-2018.pdf

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app