← NDPA 2023 · Data subject rights

s.34(1)(a)-(c) — Right of access and rectification

high data-subject-rights

Requirement

A data subject has the right to obtain confirmation of whether their personal data is being processed, a copy of it and information about the processing, and the correction of inaccurate, out-of-date or incomplete data, without undue delay (s.34(1)(a)–(c)).

What the engine looks for

Every group below must be satisfied — by an affirmative statement, not a plan, a hedge or a denial — for the control to count as covered. A term ending in … matches any word it begins. Supporting terms do not change the verdict — they raise confidence and distinguish a policy that names a mechanism from one that gestures at a category.

Required element 1 — any one of
right of accessaccess requestsubject accessrectif…correctaccess to their personal dataaccess to personal datacopy of their personal datacopy of their data
Required element 2 — any one of
respondprocessprocedurerequest
Supporting terms — specificity signals
section 34identity verificationtimeframelogtemplatefree of charge
Contradiction markers

Finding any of these outranks coverage — a policy that admits the gap is worse than silence.

no process for data subject requests

Equivalent controls elsewhere

Matched on shared topics. Satisfying this control usually moves these too.

FrameworkControlTitleShared topics
GDPR Art.15 Right of access data-subject-rights
GDPR Art.18 Right to restriction of processing data-subject-rights
GDPR Art.20 Right to data portability data-subject-rights
GDPR Art.22 Automated decision-making and profiling data-subject-rights
CCPA/CPRA 1798.110 & 1798.115 Right to know and access data-subject-rights
CCPA/CPRA 1798.125 Non-discrimination and financial incentives data-subject-rights
CCPA/CPRA 1798.130(a)(1)-(2) Methods for requests and 45-day response data-subject-rights
CCPA/CPRA Regs (ADMT) Automated decision-making technology for significant decisions data-subject-rights