LexLint.ioBeta

Know the law your code answers to.

Law / Botswana

Data Protection Act, 2024, rights of data subjects

Data Protection Act, 2024 (Act No. 18 of 2024), Part VIII (ss. 37-48)

In force since .

A data subject rights rule binding public and private bodies.

Obligation class
Data subject rights
Audit expectation
none

What it requires

  • Provide a data subject, on request, with confirmation of whether their personal data is being processed, and where it is, access to it and to information on the purpose of processing, the categories of data, the recipients, the retention period, and the existence of automated decision-making, including profiling.NIST Privacy FrameworkCT.DM-P1
  • Act on a data subject's request to rectify, erase, restrict the processing of, port, or object to the processing of their personal data, and inform the data subject of the outcome without undue delay and, in any event, within one month of receipt of the request, extendable by up to two further months with the Commission's approval.NIST Privacy FrameworkCT.PO-P3

These lines are LexLint's reading of the law's text.

In the frameworks

NIST Privacy Framework
  • CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
  • CT.DM-P1Data elements can be accessed for review.
FINOS AIGF

Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law

What it makes you log

Logging duty

Part VIII (ss. 37-48) sets the data subject's rights of information, access, rectification, erasure, restriction, portability and objection, and the controller's duty to act within one month. It names no log, register or record that must be kept or produced; the access right of section 42 describes what the data subject may be told, not a record the controller must hold. The cited Part states no territorial scope clause.

Kind
None
As of

What this law does

Drafted with AI

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made

Research summary

Legal information, not legal advice. This is LexLint's own research summary of a public legal source, and it creates no attorney-client relationship. For decisions that matter, consult qualified counsel in the relevant jurisdiction. About LexLint

A data subject has the right to obtain confirmation of whether their personal data is being processed and, where it is, access to it together with information on the purpose of processing, the categories of data, the recipients, the retention period, and the existence of automated decision-making, including profiling.

A data controller must act on a data subject's request to rectify, erase, restrict the processing of, port, or object to the processing of their personal data, and must inform the data subject of the outcome without undue delay and, in any event, within one month of receipt of the request, extendable by up to two further months with the Commission's approval.

When LexLint raises it

When your app profile says your app makes high-risk automated decisions or processes personal data.

Back to the example  ·  Lint your app

Page updated .