LesothoData Protection Act, 2011, rights of data subjects
Data Protection Act, 2011, ss. 25-27, 50 (rights of data subjects)
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2024. Publisher's page: https://lesotholii.org/akn/ls/act/2012/5/eng@2012-02-22In force since .
A data subject rights rule binding public and private bodies.
- Obligation class
- Data subject rights, Disclosure
- Audit expectation
- none
What it requires
- Give a data subject notice, before or as soon as practicable after collecting personal information about them, of your name and address, the purpose of the collection, whether supply is mandatory, and the consequences of not providing it.NIST Privacy FrameworkCM.AW-P1
- Confirm free of charge, on request from a data subject who proves their identity, whether you hold personal information about them, and provide it in a reasonable manner, format and prescribed time.NIST Privacy FrameworkCT.DM-P1
- Give a data subject written reasons where you deny an access request, and let them challenge those reasons.NIST Privacy FrameworkCT.PO-P3NIST Privacy FrameworkGV.MT-P7
- Correct, destroy, or delete personal information on a data subject's request within 14 days where it is inaccurate, irrelevant, excessive, out of date, incomplete, misleading, or unlawfully obtained, and tell anyone the changed information was disclosed to within 7 working days of the correction where it affects a decision about the data subject.NIST Privacy FrameworkCT.PO-P3NIST Privacy FrameworkCM.AW-P5
- Stop processing a data subject's personal information for direct marketing as soon as they give you notice requiring you to cease or not begin such processing.NIST Privacy FrameworkCT.PO-P3
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- GV.MT-P7Policies, processes, and procedures for receiving, tracking, and responding to complaints, concerns, and questions from individuals about organizational privacy practices are established and in place.
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
- CT.DM-P1Data elements can be accessed for review.
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
- CM.AW-P5Data corrections or deletions can be communicated to individuals or organizations (e.g., data sources) in the data processing ecosystem.
- FINOS AIGF
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Sections 25 to 27 and 50 give the data subject notice at collection, access to the information held (including the identity of third parties who have or have had access), correction and deletion, and a stop on direct marketing, and require the controller to tell those who received corrected information within seven working days and to give the outcome of a request within 14 days. Section 26(1)(b) lets the data subject ask who has had access but does not require a record of disclosures to be kept. No section in the row requires a log, register or record or names a check of one. The row has no scope clause among its cited provisions.
- Kind
- None
- As of
What this law does
Section 25 requires a data controller that collects personal information directly from a data subject to take reasonably practicable steps, before or as soon as practicable after collection, to make the data subject aware of the information being collected, the controller's name and address, the purpose of collection, whether the supply of the information is mandatory, the consequences of not providing it, and the existence of the rights of access and rectification.
Section 26 gives a data subject who proves their identity the right to request free confirmation of whether a controller holds personal information about them and to request that information, including the identity of third parties who have had access to it, and gives a right to written reasons and a right to challenge those reasons where a request is denied.
Section 27 gives a data subject a free right to have inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained personal information corrected or deleted, requires the controller to answer the request within 14 days, and requires the controller to tell every party the changed information had been disclosed to within 7 working days where a correction affects a decision about the data subject.
Section 50 entitles a data subject to require a controller by notice to cease, or not begin, processing their personal data for direct marketing, and lets the Commission order compliance where the controller fails to observe that notice.
When LexLint raises it
When your app profile says your app sends automated outreach or processes personal data.
Back to the example · Lint your app
Page updated .