Data Protection Act, 2022, rights of data subjects

Data Protection Act, 2022, ss. 19-20, 44-45, 51 (rights of data subjects)

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force since 4 March 2022.

A data subject rights rule binding public and private bodies.

As of 19 September 2026.

What it requires

Confirm free of charge, on request from a data subject who proves their identity, whether you hold personal information about them, and provide it in a reasonable manner, format and prescribed time.
Give a data subject written reasons where you deny an access request, and let them challenge those reasons.
Correct, destroy, or delete personal information on a data subject's request within fourteen days where it is inaccurate, irrelevant, excessive, out of date, incomplete, misleading, or unlawfully obtained, and tell anyone the changed information was disclosed to within seven working days of the correction where it affects a decision about the data subject.
Stop processing a data subject's personal information for direct marketing as soon as they give you notice requiring you to cease or not begin such processing.
Do not base a decision that has a legal effect on a person, or that significantly affects them, solely on automated processing of their personal information intended to profile their personality or habits, except where taken under a contract at their request or under a law, code or scientific standard with safeguards in place.
If you operate a whistleblowing system, preserve fairness, proportionality and openness about its scope and purpose, and inform a person implicated in a report as soon as possible of the report's existence and the facts alleged.
Let a person implicated in a whistleblowing report exercise their rights of access, rectification and deletion, but do not give them access to a third party's personal data without that third party's express written consent.

What it reaches

Obligation class

Data subject rights, Disclosure

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Section 19 gives a data subject who proves their identity the right to request free confirmation of whether a controller holds personal information about them and to request that information, including the identity of third parties who have had access to it, and gives a right to written reasons and a right to challenge those reasons where a request is denied.

Section 20 gives a data subject a free right to have inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained personal information corrected or deleted, requires the controller to answer the request within fourteen days, and requires the controller to tell every party the changed information had been disclosed to within seven working days where a correction affects a decision about the data subject.

Section 44 entitles a data subject to require a controller by notice to cease, or not begin, processing their personal data for direct marketing, and lets the Commission order compliance where the controller fails to observe that notice.

Section 45 bars a decision that has a legal effect on a person, or that significantly affects them, from being based solely on automated processing of their personal information intended to profile their personality or habits, unless the decision is taken in connection with a contract at the data subject's request with appropriate safeguards, or is governed by a law, code or body of scientific proof that specifies appropriate protective measures.

Section 51 requires a data controller that operates a whistleblowing system to preserve fairness, proportionality and openness about the scope, purpose and consequences of reporting, and requires a person implicated in a report to be informed as soon as possible of the report's existence and the facts alleged, with a right of access, rectification and deletion that does not extend to a third party's personal data without that person's express written consent.

When LexLint raises it

crawls_web
trains_models
automated_outreach
high_risk_decisions

Read the law

Data Protection Act, 2022, official Government Gazette Extraordinary text hosted by the Eswatini Communications Commission (ESCCOM)

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app