119/04/23

DATA PROTECTION OFFICE {PMO}What does the right of access stand

for?

All data subjects (including parents, legal

guardians or any person duly authorised

in writing by the data subject) have the

right to access their own personal details

kept by the data controller;

Suffice that they fill the request for access

to personal data form available on the

homepage of our website and submit it to

the data controller concerned and not the

Data Protection Office together with a

payment of RS 75 as provided in the Data

Protection regulations of 2009.

219/04/23

DATA PROTECTION OFFICE {PMO}

The data controller is then required to supply the data subject with a copy of the personal information on the individual that it possesses, the purposes for which the data are kept and the people or institutions that the data may be disclosed to within 28 days of the receipt of the request.

Where the data controller is unable to comply with the request, it must so inform the data subject within the period of 28 days and as soon as practicable , comply with the request.

319/04/23

DATA PROTECTION OFFICE {PMO}

A data controller may refuse to accede to such a request for disclosure:-

Where he is not provided with sufficient information -as to the identity of the requestor and- to locate the information requested; or

Where compliance with the request will result in the contravention of a legal confidentiality obligation; or

Where the information relates to the education, training or employment, provision of service by the data subject; or

Where compliance with the request will expose the data controller to legal proceedings for the commission of an offence.

419/04/23

DATA PROTECTION OFFICE {PMO}

Where the data controller is also in possession of associated personal data of another individual/s , he may refuse to disclose that data unless that other indivudual/s has/ve consented to the disclosure or he obtains the written autorisation of the Commissioner.

The data controller has to erase, rectify, block or destroy as appropriate or notify as soon as is reasonably practicable the third party holding inaccurate data where he has been informed of the inaccurateness of the data.

Failure by the data controller to do so will give rise to the right of the data subject to apply to the Commissioner for needful to be done.

519/04/23

DATA PROTECTION OFFICE {PMO}

Such requests have to be made at reasonable intervals. Otherwise , the data controller may be entitled to refuse the request.

Some practical tips for handling requests for access to personal data forms:-

Appoint a Co-ordinator or a Data Protection Officer who will be responsible for the response to the access request. A description of the functions and responsibilities of the Co-ordinator should be circulated within the organisation and staff should be advised of the necessity for co-operation with the Co-ordinator.

All subject access matters should be submitted to the Co-

ordinator.619/04/23

DATA PROTECTION OFFICE {PMO}

Check the validity of the access request. Ensure that it is in writing, that the appropriate fee of Rs 75 is included.

Log the date of receipt of the valid request.

719/04/23

DATA PROTECTION OFFICE {PMO}

819/04/23