Responding to Access and Correction Requests Under The PDPA

6 June 2014

Dharma Sadasivan

The Personal Data Protection Regulations 2014 ("Regulations") set out some new details about compliance with the Access & Correction and Transfer obligations of the Personal Data Protection Act 2012 ("PDPA"). I'm just going to address the Access & Correction obligations in this post.

Access & Correction

• The request must be made in writing
• It must include sufficient detail to enable the organisation, with reasonable effort, to identify the applicant making the request.
• Where the request is an access request, it must enable the organisation to identify the personal data, use and disclosure information requested by the applicant. 
• Where it is a correction request, it must enable the organisation to identify the correction requested by the applicant. 
• Requests may be sent to the Data Protection Officer's ("DPO") business contact information provided, or in other manners in which Nestle accepts service of documents, such as leaving it at, or by sending it by pre-paid post to, the organisation's registered office.

Form of providing personal data:
Upon receiving an access request, the organisation must provide the applicant with a copy of the personal data and use/disclosure information, but if this is impracticable, it must allow the applicant a reasonable opportunity to examine the personal data and use/disclosure information, or provide it in another form requested by the applicant that is acceptable to the organisation.

Timelines:
The organisation needs to comply with access or correction requests within 30 days of receiving the request. If it can't, it must inform the applicant in writing of when it will respond to the request within those 30 days. Best practice is also to provide an explanation for why it can't respond within 30 days.

Refusal to confirm/deny existence of personal data:
The organisation can refuse to confirm or deny the existence, use or disclosure of personal data in response to an access request if investigations or proceedings (and any related appeals) have not been completed. This prevents tipping off individuals about ongoing investigations or proceedings.

Fees:
Reasonable fees can be charged for access requests. To do so, the organisation must provide the applicant with a written estimate of the fee, or written notice of any increase in the fee. The organisation doesn't need to respond to an access request if the applicant refuses to pay the fee. The fee shouldn't be unreasonable or have the effect of being obstructive, and keep in mind that the Commission may review the fee (or increased fee). Fees cannot be charged for correction requests.

That's it for the Access & Correction updates from the Regulations. Post on the Regulation's Transfer updates coming soon.

​
Dharma Sadasivan
Associate Director, BR Law Corporation
[email protected]