Data Protection Act, 2023, automated decisions
Data Protection Act, 2023 (Act 24 of 2023), s. 30(2) (automated individual decisions)
In force since .
A data subject rights rule binding public and private bodies.
- Private right of action
- Yes
As of .
What it requires
- Expect Ministerial regulations to impose measures safeguarding a data subject's rights where a qualifying significant decision about them is based solely on automated processing.
What this law does
Section 30(2) empowers the Minister, in consultation with the Commission, to make regulations imposing suitable measures to safeguard a data subject's rights, freedoms and legitimate interests where a qualifying significant decision about them is taken solely on automated processing.
The Act does not itself state what those measures must be: it is a rule-making power rather than a right the data subject or a court can enforce directly, and it takes effect only once the Minister issues implementing regulations.
When LexLint raises it
When your app profile says your app makes high-risk automated decisions.