Data Protection Act, 2023, rights of data subjects
Data Protection Act, 2023 (Act 24 of 2023), ss. 25-32 (data subjects rights)
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
In force since 22 December 2023.
A data subject rights rule binding public and private bodies.
As of 6 September 2026.
What it requires
- Give a data subject access to, and the ability to correct or delete, their personal data on request.
- Provide a data subject's personal data in a structured, machine-readable and interoperable format on a portability request.
- Expect Ministerial regulations to impose measures safeguarding a data subject's rights where a qualifying significant decision about them is based solely on automated processing.
If you get it wrong
Private right of actionYes
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
A data subject has the right to be informed of the use of their personal data, to access it, to have it rectified or deleted, to object to processing for a specific purpose, and to receive it in a structured, machine-readable and interoperable format for portability to another controller. The Minister may make regulations to safeguard a data subject's rights in connection with a decision based solely on automated processing.
Any person who suffers material or non-material damage from a contravention of the Act has a right to compensation from the data controller or processor responsible.
When LexLint raises it
high_risk_decisionscrawls_webtrains_modelsdeploys_chatbot