Personal Data Protection Act, 2022, rights of data subjects
Personal Data Protection Act 2022 (Act No. 11 of 2022), Part VI (ss. 33-38, rights of data subjects, including automated decision-making, s. 36, and compensation, s. 37)
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
In force since 1 May 2023.
A data subject rights rule binding public and private bodies.
As of 6 September 2026.
What it requires
- Do not base a decision that significantly affects a data subject solely on automated processing unless a statutory exception applies, and allow the subject to require reconsideration.
- Compensate a data subject who suffers damage from your contravention of the Act.
If you get it wrong
Private right of actionYes
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
A data subject is entitled to be informed whether a controller is processing their personal data and to a description of that processing. Section 36 gives a data subject the right to require a controller to ensure that a decision significantly affecting them is not based solely on automated processing, subject to exceptions for contract performance, statutory authorisation or the subject's explicit consent, and lets the subject require the controller to reconsider the decision.
Section 37 entitles a data subject who suffers damage from any contravention of the Act to compensation from the controller or processor, and the Commission may separately order payment of compensation as part of its enforcement powers.
When LexLint raises it
high_risk_decisionscrawls_webtrains_modelsdeploys_chatbot