GuyanaData Protection Act 2023, rights of data subjects and information to be provided
Data Protection Act 2023, ss. 11-18 and 20-22 (rights of data subjects)
A data subject rights rule binding public and private bodies.
- Obligation class
- Data subject rights, Disclosure
As of .
What it requires
- Once the Data Protection Act 2023 is commenced, tell a data subject on request whether you process their personal data, give them the description section 11 lists and a copy, and provide it in electronic form where the request is electronic.
- Rectify inaccurate personal data and erase personal data without undue delay where a section 13(2) ground applies, such as withdrawal of consent, and tell each recipient of a rectification, erasure or restriction unless that is impossible or involves disproportionate effort.
- Restrict processing on a section 14 ground, give a data subject the personal data they provided in a structured, commonly used and machine-readable format, and transmit it to another controller where processing is by automated means on consent or contract.
- Stop processing personal data for direct marketing when the data subject objects, and cease or do not begin processing that the data subject requires in writing you to stop because it is causing or likely to cause substantial, unwarranted damage or distress.
- Give a data subject at collection, or within one month where the data came from another source, the information sections 20 and 21 list, including your identity, the purposes and legal basis, the recipients, the retention period, their rights and the right to complain to the Commissioner.
- Answer a data subject's rights request without undue delay and within one month of receipt, extend that period by two months only for complex or numerous requests and tell the data subject of the extension and the reasons within the first month, and provide the response free of charge.
These lines are LexLint's reading of the law's text, as of .
What this law does
Section 11 gives a data subject the right to be told whether a data controller processes the data subject's personal data, to be given a description of the purposes, categories, recipients, retention period and source, and to be given a copy. Sections 12 and 13 give rights to rectification and erasure. Section 13(2) lists the grounds on which the controller shall erase personal data without undue delay, including withdrawal of consent.
Section 14 gives a right to restriction of processing and section 15 requires the controller to tell each recipient of a rectification, erasure or restriction. Section 16 gives a right to receive personal data in a structured, commonly used and machine-readable format and to have it transmitted to another controller. Section 17 gives a right to object, including to processing for direct marketing.
Section 18 lets a data subject require a controller in writing to cease or not begin processing that is causing or likely to cause substantial and unwarranted damage or distress. Sections 20 and 21 require the controller to give the data subject the information they list, at collection or, where the data came from another source, within a reasonable period and at the latest within one month.
Section 22 requires a response without undue delay and in any event within one month of receipt of the request, extendable by two months for complex or numerous requests, free of charge. Section 1 provides that the Act comes into operation on the day the Minister appoints by order, and that different days may be appointed for different provisions. The Act was gazetted on following passage on . No commencement order has been located.
When LexLint raises it
When your app profile says your app crawls the web, trains models, deploys a chatbot or sends automated outreach.