South AfricaProtection of Personal Information Act Regulations, objection and correction requests
Regulations Relating to the Protection of Personal Information 2018, regulations 2 and 3, as substituted by Government Notice 6126 of
In force since .
A data subject rights rule binding public and private bodies.
- Obligation class
- Data subject rights, Disclosure
As of .
What it requires
- Accept a data subject's objection to the processing of their personal information at any time during your office hours and free of charge, on a form substantially similar to Form 1 that is reasonably accessible by hand, fax, post, email, SMS or WhatsApp.
- When you collect personal information, tell the data subject that they have the right to object to its processing.
- Record electronically an objection made by telephone, and make the recording available to the data subject on request, including as a transcription.
- Accept a data subject's request for the correction or deletion of personal information, or for the destruction or deletion of a record of it, at any time and free of charge, on a form substantially similar to Form 2 that is reasonably accessible by hand, fax, post, email, SMS or WhatsApp message; record a request made by telephone and make the recording available on request, free of charge.
- Notify the data subject in writing of the action taken on a correction or deletion request within thirty days of receipt of the outcome of the request.
These lines are LexLint's reading of the law's text, as of .
What this law does
Regulation 2 requires a responsible party to take a data subject's objection to the processing of their personal information at any time during the responsible party's office hours and free of charge. The objection is made on a form substantially similar to Form 1, which the responsible party must make reasonably accessible by hand, fax, post, email, SMS or WhatsApp. A responsible party must also notify the data subject of the right to object when it collects their personal information.
It must record electronically an objection made by telephone and make the recording available to the data subject on request. Regulation 3 gives a data subject the right to ask, at any time and free of charge, for the correction or deletion of personal information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or obtained unlawfully.
The request is made on a form substantially similar to Form 2, which the responsible party must make reasonably accessible by hand, fax, post, email, SMS or WhatsApp message. A request made by telephone must be recorded. The responsible party must notify the data subject in writing of the action taken within thirty days of receipt of the outcome of the request.
The Information Regulator published the amended Regulations in Government Gazette 52523 on for implementation with immediate effect.
When LexLint raises it
When your app profile says your app crawls the web, trains models, deploys a chatbot or sends automated outreach.