Rights of data subjects
A data subject has the right to have his, her or its personal information processed in accordance with the conditions for the lawful processing of personal information as referred to in Chapter 3, including the right— (a) to be notified that— (i) personal information about him, her or it is being collected as provided for in terms of section 18; or (ii) his, her or its personal information has been accessed or acquired by an unauthorised person as provided for in terms of section 22; (b) to establish whether a responsible party holds personal information of that data subject and to request access to his, her or its personal information as provided for in terms of section 23; (c) to request, where necessary, the correction, destruction or deletion of his, her or its personal information as provided for in terms of section 24; (d) to object, on reasonable grounds relating to his, her or its particular situation to the processing of his, her or its personal information as provided for in terms of section 11(3)(a); (e) to object to the processing of his, her or its personal information— (i) at any time for purposes of direct marketing in terms of section 11(3)(b); or (ii) in terms of section 69(3)(c); (f) not to have his, her or its personal information processed for purposes of direct marketing by means of unsolicited electronic communications except as referred to in section 69(1); (g) not to be subject, under certain circumstances, to a decision which is based solely on the basis of the automated processing of his, her or its personal information intended to provide a profile of such person as provided for in terms of section 71; (h) to submit a complaint to the Regulator regarding the alleged interference with the protection of the personal information of any data subject or to submit a complaint to the Regulator in respect of a determination of an adjudicator as provided for in terms of section 74; and (i) to institute civil proceedings regarding the alleged interference with the protection of his, her or its personal information as provided for in section 99.
What this means for your estate
- This is the resident-facing summary of everything else in the Act, nine rights, each pointing to the section that actually governs it. Worth treating as a checklist for your own POPIA/privacy notice: does it tell residents how to exercise each of these?
- (b) and (c) are the two your Information Officer will field most often in practice, a resident asking “what do you have on file about me” (access) or “please correct/delete this” (correction, destruction or deletion), and both need a documented, working process, not an ad-hoc email reply.
- (h) and (i) are the escalation paths if a resident isn't satisfied with how your estate handled a request, a Regulator complaint or civil proceedings. Handling requests properly at (b)/(c) stage is what keeps things from reaching (h)/(i).
PopiGuard's resident request workflow covers each of these rights end to end, notify, access, correct, object, so nothing falls through to a Regulator complaint.