Data Subject Rights Under POPIA: What Businesses Must Know

Section 5 of POPIA grants data subjects (individuals whose personal information is processed) specific rights that organisations are legally required to respect. Failing to respond appropriately to a data subject request is itself a POPIA violation and can result in a complaint to the Information Regulator.

The Six Core Data Subject Rights

1. Right of Access

Data subjects have the right to request confirmation of whether an organisation holds their personal information and to receive a copy of that information. Requests must be responded to within a reasonable time — POPIA does not specify an exact period, but within 30 days is generally considered the standard.

2. Right to Correction

If personal information is inaccurate, incomplete or outdated, the data subject has the right to request correction or deletion. The organisation must either make the correction or explain why it declines to do so.

3. Right to Deletion

Data subjects may request the deletion of personal information where it is no longer necessary for the purpose for which it was collected, where consent has been withdrawn, or where it was unlawfully processed. Deletion requests do not override legal retention obligations — if the law requires you to keep a record, you may decline a deletion request for that reason.

4. Right to Object

Data subjects may object to processing for legitimate interest grounds or for direct marketing purposes. An objection to direct marketing must be honoured immediately and permanently.

5. Right to Lodge a Complaint

Every data subject has the right to lodge a complaint with the Information Regulator of South Africa. The Regulator may investigate, require remediation, and impose sanctions.

6. Right Not to Be Subject to Automated Decisions

Data subjects have the right not to be subject to decisions taken solely on the basis of automated processing that significantly affect them, without human review.

What Organisations Must Have in Place

• A published process for submitting data subject requests (typically via the Information Officer)
• A template for acknowledging and tracking requests
• An internal process for locating personal information on request (requires an organised document environment)
• A decision-making framework for when requests may be declined (legal hold, third-party rights, disproportionate effort)
• A log of all requests received and how they were resolved

The PAIA Manual Requirement

Under PAIA, private organisations are required to have a PAIA manual that describes how access to information (including personal information) may be requested. This manual must be submitted to the South African Human Rights Commission. Many organisations have not done this, which is itself a compliance gap.

Practical Considerations

In practice, the biggest challenge with data subject rights is finding the personal information on request. An organisation with a disorganised file system and no data map will struggle to respond to access requests within a reasonable timeframe. A repository assessment and proper document classification are prerequisites for managing data subject rights effectively.