Protection of Personal Information Act, 2013 (Act No. 4 of 2013)RegulationsRegulations relating to the Protection of Personal Information, 20183. Request for correction or deletion of personal information or destruction or deletion of record of personal information |
| 3.1 | A data subject has the right, in terms of section 24 of the Act, to request, where necessary, the correction, destruction, or deletion of his, her or its personal information. |
| 3.2 | A data subject, who wishes to request a correction or deletion of his, her, or its personal information, as provided for in section 24(1)(a) of the Act, has the right to request for correction or deletion of personal information at any time and free of charge, if the personal information is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or obtained unlawfully. |
| 3.3 | A data subject, who wishes to request the destruction or deletion of a record of his, her, or its personal information, in terms of section 24(1)(b) of the Act, has the right to request the destruction or deletion of a record of his, her or its personal information at any time and free of charge, if a responsible party is no longer authorised to retain in terms of section 14 of the Act. |
| 3.4 | A request for a correction or deletion of personal information, as referred to in sub regulation 3.2 or a request for the destruction or deletion of a record of personal information, as referred to sub regulation 3.3 must be submitted to a responsible party on a form which is substantially similar to Form 2 free of charge and reasonably accessible to a data subject by hand, fax, post, email, SMS, WhatsApp message or in any manner expedient to a data subject; |
| 3.5 | A request for a correction or deletion of personal information by telephonic means shall be recorded by a responsible party and such recording must, upon request, be made available to a data subject in any manner, including the transcription thereof which shall be free of charge. |
| 3.6 | A responsible party must, within thirty (30) days of receipt of the outcome of the request referred to in sub regulation 3.2 or 3.3, notify a data subject, in writing, of the action taken as a result of the request. |
[Regulation 3 substituted by Notice No. 6126, GG52523, dated 17 April 2025]