Right of access: getting a copy of your personal data

Section 42 of the Data Protection Act, 2024 gives every data subject two connected rights: to find out whether a business is processing their personal data at all, and, if it is, to get access to that data along with a defined set of information about how it is being used. It is the right most people mean when they say they want to see “what a company has on them.”

A former employee asking their old HR department for a copy of their personnel file is a straightforward example. Under section 42, that request is not a favour HR can decide to grant. It is a right, with a legal deadline attached.

What the right actually covers

Section 42(1) sets out the core of it:

The data subject shall have the right to obtain from the data controller confirmation as to whether personal data concerning him or her is being processed, and, where that is the case, access to the personal data and the information relating to [it]. (s.42(1))

In practice, “the information relating to it” means a business handling an access request has to hand over, alongside the data itself:

• The purpose the data is being processed for.
• The categories of personal data involved.
• The recipients, or categories of recipients, the data has been or will be disclosed to, including any outside Botswana.
• The retention period, or if that is not fixed, the criteria used to decide it.
• The existence of the right to object, correct, delete or restrict processing of the data.
• The existence of the right to complain to the Commission.
• The source of the data, where it was not collected from the person directly.
• The existence of any automated decision-making, including profiling, along with the logic involved and what it means for the person.

Section 42(3) also requires the controller to hand over an actual copy of the data undergoing processing, not just a description of it. Where the request was made electronically, section 42(4) says that copy should come back in a commonly used electronic format unless the person asks otherwise.

The one-month clock

The right of access is one of the rights governed by section 38’s response process: a controller has one month from receiving the request to act, extendable by two months for complex or numerous requests where the Commission approves and the person is told about the extension within that first month. The full mechanics of that process, including what counts as a valid request, are covered on how to exercise your rights.

What it is not

The right of access is not a right to see everyone else’s data alongside your own. Where a personnel file, for example, contains information about other employees mixed in with the requester’s own record, a business has to work out what it can disclose without exposing someone else’s personal data as a side effect of answering the request.