7
Data Protection Act, 2018 - 5. ...............................................
PART III
RIGHTS OF DATA SUBJECTS
14. Right of access to personal data.
Subject to the provisions of this Act, a public body or a private body shall, on the written
request of and the payment of the prescribed fee by a person for access to personal data–
(a) inform the person whether personal data of which that person is the data subject
is being processed by or on behalf of that body;
(b) if personal data is being processed by or on behalf of that body, communicate
to the person in an intelligible form a description of–
(i) the personal data of which that person is the data subject;
(ii) the purposes for which the personal data is being or will be processed;
(iii) the recipients or classes of recipients to whom personal data is or may be
disclosed; and
(iv) any information available to the body as to the source of the data.
15. Notice and time where access is requested.
(1) Subject to section 16, where access to personal data is requested under section 14,
the public body or private body to which the request is made shall, subject to subsection
(2), within thirty days after the request is received –
(a) give written notice to the person who made the request as to whether or not
access to the personal data or a part thereof will be given; and
(b) if access is to be granted, give to the person who made the request access to
the personal data or a part thereof.
(2) A Chief Executive Officer may extend the time limit for compliance with a request
for access to personal data –
(a) by a maximum of thirty days if–
(i) meeting the original time limit would unreasonably interfere with the
operations of the public body or private body;
(ii) consultations are necessary to comply with the request that cannot be
reasonably be completed within the original time limit; or
(b) by such period of time as is reasonable, if the additional time is necessary for
converting the personal data into an alternative format;
by giving notice of the extension and the length of the extension to the person who made the
request within thirty days after the request is received, and a statement that the person has
a right to make a complaint to the Information Commissioner about the extension.
16. Denial of access to personal data.
(1) A public body or a private body is not obliged to comply with a request for access
to personal data–