Data subject rights under the Data Protection Act

Part VIII of the Data Protection Act, 2024 is the part that belongs to the person the data is about, not the business processing it. Sections 37 to 49 give every data subject eight distinct rights over their own personal data, plus a set of rules that force businesses to be upfront about what they are doing with it in the first place.

The eight rights

Right of access (s.42): confirm whether a business holds your data, and get a copy along with details of how it is used.
Right to correction (s.43): have inaccurate data fixed and incomplete data completed.
Right to deletion (s.44): have your data erased, where one of a specific set of grounds applies.
Right to restrict processing (s.45): freeze active use of your data, short of deleting it, usually while something is disputed.
Right to data portability (s.47): get your data in a reusable format, or have it sent straight to another provider.
Right to object (s.48): stop processing based on public interest or legitimate interests, and stop direct marketing outright.
Protection from automated decision-making (s.49): not be subject to a decision made by a machine alone, where it has a legal or similarly significant effect on you.
How to actually exercise these rights: the practical process behind all seven, in one place.

The general shape of Part VIII

Three provisions apply across all eight rights rather than to just one of them.

Section 37 sets a baseline for how any information addressed to a data subject has to be delivered:

The data controller shall take appropriate measures to provide information relating to processing in a concise, transparent, intelligible and easily accessible form using clear and plain language. (s.37)

Section 38 sets the process for exercising any of the rights in sections 42 to 49: a controller has one month to respond, extendable by a further two months for complex or numerous requests, provided the Commission approves and the data subject is told about the extension and the reasons for it within that first month.

Sections 39 to 41 work in the other direction. Rather than waiting for someone to ask, they require a controller to proactively tell a data subject certain things about the processing, such as who the controller is, why the data is being processed, who it might be shared with, and how long it will be kept, generally at the point the data is collected. Section 41 adds an extra duty where the data was not collected from the person directly: the controller also has to say where it came from.

Put together, Part VIII is not one right with eight names on it. It is a right to be told things upfront (ss.37, 39 to 41), a common process for acting on a request once one is made (s.38), and eight separate outcomes a data subject can ask for (ss.42 to 49), each with its own conditions. The pages linked above go through each of those eight in the detail a real request actually needs, and how to exercise your rights walks through the process itself.

Educational information only, not legal advice. Source: Data Protection Act, 2024 (Act No. 18 of 2024), s.37, s.38, s.39, s.40, s.41, s.42, s.43, s.44, s.45, s.46, s.47, s.48, s.49. Last reviewed: 7 September 2026.

Questions about data subject rights under the data protection act

Eight, set out across sections 42 to 49 of Part VIII: access, correction, deletion, restriction of processing, data portability, objection, and protection from purely automated decisions. Sections 37 to 41 then set the process and the proactive disclosure duties that sit around all eight.

Section 38 requires a controller to act, or to explain in writing why it has not, within one month. If it does neither, that failure itself is something you can take to the Information and Data Protection Commission.

No, not as a rule. A controller cannot charge for handling a normal request under sections 39 to 49. The one exception is a request that is manifestly unfounded or excessive because of how often it repeats, where a reasonable administrative fee can apply.