Access to personal information
(1) A data subject, having provided adequate proof of identity, has the right to— (a) request a responsible party to confirm, free of charge, whether or not the responsible party holds personal information about the data subject; and (b) request from a responsible party the record or a description of the personal information about the data subject held by the responsible party, including information about the identity of all third parties, or categories of third parties, who have, or have had, access to the information— (i) within a reasonable time; (ii) at a prescribed fee, if any; (iii) in a reasonable manner and format; and (iv) in a form that is generally understandable.
(2) If, in response to a request in terms of subsection (1), personal information is communicated to a data subject, the data subject must be advised of the right in terms of section 24 to request the correction of information.
(3) If a data subject is required by a responsible party to pay a fee for services provided to the data subject in terms of subsection (1)(b) to enable the responsible party to respond to a request, the responsible party— (a) must give the applicant a written estimate of the fee before providing the services; and (b) may require the applicant to pay a deposit for all or part of the fee.
(4) (a) A responsible party may or must refuse, as the case may be, to disclose any information requested in terms of subsection (1) to which the grounds for refusal of access to records set out in the applicable sections of Chapter 4 of Part 2 and Chapter 4 of Part 3 of the Promotion of Access to Information Act apply. (b) The provisions of sections 30 and 61 of the Promotion of Access to Information Act are applicable in respect of access to health or other records.
(5) If a request for access to personal information is made to a responsible party and part of that information may or must be refused in terms of subsection (4)(a), every other part must be disclosed.
What this means for your estate
- This is the legal basis behind every Data Subject Access Request an estate receives, subsection (1)(a) is free, subsection (1)(b) can carry a prescribed fee, and both have to be answered “within a reasonable time,” not indefinitely deferred.
- Subsection (1)(b) specifically includes disclosing which third parties have had access to the resident's information, a request can't be answered with just the estate's own records if a managing agent or vendor also held the data.
- Subsection (5)'s partial-disclosure rule matters in practice: an estate can't refuse an entire request because one part of it (say, another resident's information mixed into a complaint file) is legitimately withheld, the rest still has to go out.
PopiGuard's DSR workflow tracks the request clock and prompts partial disclosure where only part of a record needs to be withheld.