GrenadaData Protection Act, No. 1 of 2023, rights of data subjects
Data Protection Act, No. 1 of 2023, ss. 8, 13 and 15-19 (rights of data subjects)
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2024. Publisher's page: https://www.laws.gov.gd/index.php/acts/971-act-no-1-of-2023-data-protection-2023/viewdocument/971A data subject rights rule binding public and private bodies.
- Obligation class
- Disclosure, Data subject rights, Access restriction
- Audit expectation
- none
What it requires
- Give the data subject notice of the purpose and source of collection, their access and rectification rights, the classes of third party the data may be disclosed to, and whether supplying the data is obligatory, when they request it.NIST Privacy FrameworkCM.AW-P1
- Give a data subject access to, and let them rectify, their personal data on written request, unless a refusal ground under the Act applies.NIST Privacy FrameworkCT.DM-P1NIST Privacy FrameworkCT.DM-P3
- Confirm within thirty days of a written access request, accompanied by the prescribed processing fee, whether access will be given, and if so give access within sixty days, subject to an extension of up to thirty more days in narrow circumstances.NIST Privacy FrameworkCT.PO-P3
- State the specific ground for any refusal of access in the written notice, together with the data subject's right to complain to the Commission about the refusal.NIST Privacy FrameworkCT.PO-P3
- Let a data subject examine their personal data or give them a copy, providing it in an alternative format where they have a sensory disability.NIST Privacy FrameworkCT.DM-P1
- Amend personal data on a data subject's application where it is incomplete, incorrect, misleading, excessive, or irrelevant to the purpose it is held for.NIST Privacy FrameworkCT.DM-P3
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
- CT.DM-P1Data elements can be accessed for review.
- CT.DM-P3Data elements can be accessed for alteration.
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
- FINOS AIGF
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
When a body amends personal data after a data subject's request, section 19(3) requires it, to the extent practicable, not to destroy, conceal or redact the text of the document as it existed before the amendment, so the prior text stays on record. The other cited sections (8, 13, 15 to 18) set notice, access and response-time duties and name no log, register or retention period. The Commission's power to demand information sits in section 32, which this row does not cite.
- Kind
- Implicit
- As of
- Provision
- Section 19(3)
- Trigger
- personal_data_processing
What this law does
Section 8 requires a data user, on request by a data subject, to tell the data subject the purposes and source of collecting and further processing their personal data, their right to request access and rectification, the classes of third party the data may be disclosed to, whether supplying the data is obligatory, and the consequences of not supplying it.
Section 13 gives a data subject the right to access personal data a data user holds about them and to have it rectified where it is inaccurate, incomplete, misleading or not up to date, except where access or rectification is refused under the Act.
Section 15 lets a person, on a written request and payment of a processing fee, require a public or private body to confirm whether it processes their personal data and, if so, to describe the data, the purposes of processing, the recipients or classes of recipient, and the source of the data.
Section 16 requires the body to give written notice within thirty days of whether access will be given and, if so, to give access within sixty days, subject to an extension of up to thirty more days in the circumstances section 16(2) lists.
Section 17 lets a data user refuse access where it cannot verify the requester's identity or locate the data, where an exemption under Part IV or a duty of confidentiality applies, where a third party identifiable from the data withholds consent to its disclosure, or where the Commission approves the refusal in writing, and requires the refusal notice to state the ground and the right to complain to the Commission.
Section 18 requires the body to let the data subject examine the data or give them a copy, in an alternative format where the data subject has a sensory disability and an alternative format already exists or conversion is reasonable.
Section 19 lets a data subject apply to have personal data amended where it is incomplete, incorrect, misleading, excessive or irrelevant to the purpose it is held for, and lets a data subject aggrieved by a refusal complain to the Commission within fifteen calendar days, though the section does not apply to records kept under the listed civil-registration and citizenship enactments. No notice appointing the day the Act comes into force has been located.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .