The Act gives data subjects rights to understand intended use, access information held about them, object to processing and address false or misleading information.
What to know
- ✓You have a right to be informed about the intended use of your personal information.
- ✓You may seek access to personal information held by a controller or processor.
- ✓You may object to all or part of the processing, including direct marketing without charge.
- ✓The Act provides for correction and deletion of false or misleading information; it does not state a general unlimited right to erasure.
Make a clear request
Identify yourself, the organisation involved, the information or processing you are asking about and the outcome you seek. Keep a copy and note when it was delivered. The supplied Act does not state a universal response deadline for these requests, so this site does not invent one.
Direct marketing
Where information is used for direct marketing, notices must disclose the right to object without charge. A clear opt-out should be respected and recorded across relevant systems and suppliers.
Automated decisions and consent
The Act includes protection against decisions based solely on automated processing that produce legal or similarly significant effects, subject to stated exceptions. It also allows withdrawal of consent for sensitive, genetic, biometric and health processing without explanation or charge.
Complaints and escalation
POTRAZ is designated as the Data Protection Authority. The Act empowers it to receive complaints electronically, by post or equivalent means and to investigate. Begin with the organisation where practical, preserve your correspondence and avoid sending unnecessary sensitive information in an initial enquiry.
Read the underlying material
- Cyber and Data Protection Act: sections 14–16 and 25–27
- Cyber and Data Protection Act: sections 5–6 on the Authority