Last updated: 6 August 2026
The Digital Personal Data Protection Act, 2023 gives individuals (each a “Data Principal”) a set of rights over their personal data. These rights generally apply where an organisation processes your personal data on the basis of your consent.
You can ask an organisation for a summary of the personal data it is processing about you and the processing activities it undertakes, as well as the identities of the other organisations with which your personal data has been shared, along with a description of what was shared.
You can ask for your personal data to be corrected where it is inaccurate or misleading, completed where it is incomplete, and updated where it has changed. You can also request erasure of your personal data, unless it must be retained for a legal purpose.
Organisations must provide a readily available means for you to raise a grievance about the handling of your personal data. You are expected to use this grievance mechanism first, before approaching the Data Protection Board.
You can nominate another individual who may exercise your rights under the Act on your behalf in the event of your death or incapacity.
To exercise these rights, you would ordinarily contact the organisation through the means it has published for this purpose. If a grievance is not resolved, the Act provides for escalation to the Data Protection Board.