For individuals
Your rights under the NDPA
If an organisation holds your personal data, the Act gives you rights over it. This page explains them and lets you track a request you have already sent.
Right of access and information
A data subject may obtain from the controller, without constraint or unreasonable delay, confirmation of whether the controller or a processor on its behalf is processing their personal data and, if so: the purposes, categories of data, recipients (particularly in third countries), the storage period or criteria, the existence of rights to rectification, erasure, restriction and objection, the right to complain to the Commission, the source of data not collected from the data subject, and the existence of automated decision-making including profiling and its significance.
Right to a copy of data
A data subject may obtain a copy of their personal data in a commonly used electronic format, except to the extent that providing it would impose unreasonable costs on the controller, in which case the data subject may be required to bear some or all of the costs.
Right to correction
A data subject may obtain correction or, if correction is not feasible or suitable, deletion of personal data that is inaccurate, out of date, incomplete or misleading.
Right to erasure
A data subject may obtain erasure of their personal data without undue delay. The controller must erase personal data without undue delay where the data is no longer necessary for the purposes for which it was collected or processed, or the controller has no other lawful basis to retain it.
Right to restriction of processing
A data subject may obtain restriction of processing pending resolution of a request, an objection by the data subject, or the establishment, exercise or defence of legal claims.
Withdrawal of consent
A data subject has the right to withdraw consent at any time, and the controller must ensure it is as easy to withdraw as to give consent.
Right to object
A data subject has the right to object to processing of their personal data. The controller must discontinue processing unless it demonstrates a public interest or other legitimate grounds that override the fundamental rights, freedoms and interests of the data subject.
Right to object to direct marketing
Where personal data is processed for direct marketing, including related profiling, the data subject may object at any time, and the data must then no longer be processed for that purpose.
Automated decision-making: right and exceptions
A data subject has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal or similarly significant effects. This does not apply where the decision is necessary for entering into or performing a contract, authorised by a written law with suitable safeguards, or authorised by the data subject’s consent.
Data portability
The Commission may make regulations establishing a right of data portability. That right would entitle the data subject to receive their data in a structured, commonly used and machine-readable format, transmit it to another controller without hindrance, and where technically possible have it transmitted directly between controllers. The Commission may prescribe conditions, obligations, costs and timing.
How to make a request
- Find the organisation's privacy notice and look for its rights or data protection contact. Organisations using NDPA Compass have a portal at
/rights/organisation-name. - State clearly which right you are using, what data it covers, and how they can verify who you are.
- Keep the reference and the date. The Act does not fix a number of days, it says without constraint or unreasonable delay, so keep a record of when you asked.
- If you are not satisfied, complain to the Commission.
Section 46(1)-(3)A data subject aggrieved by the decision, action or inaction of a controller or processor in violation of the Act or subsidiary legislation may lodge a complaint with the Commission. The Commission may investigate complaints that are not frivolous or vexatious and may initiate investigations of its own accord where it has reason to believe there is or is likely to be a violation.
Section 51A data subject who suffers injury, loss or harm as a result of a violation of the Act by a controller or processor may recover damages in civil proceedings.
Send a request
If the organisation uses NDPA Compass, enter the name in its portal address.