Section 11
Right to access information about personal data
Gives the Data Principal the right to a summary of her data and the processing, and to know who it has been shared with.
Read this before you cite anything here
These pages are a plain-English restatement, written to help you find the right provision and understand what it asks of you. They are not the text of the statute, and nothing here should be quoted as though it were. Section and rule numbers are exact, and every page names its source.
What it says
- (1)
- On request, the Data Principal may obtain a summary of the personal data being processed and of the processing activities, the identities of every other Data Fiduciary and Data Processor the data has been shared with together with a description of what was shared, and any other prescribed information.
- (2)
- The sharing disclosures do not apply where data was shared with another Data Fiduciary legally authorised to obtain it for the prevention, detection or investigation of offences or cyber incidents.
In practice
Answering an access request means naming every processor and recipient, which is a data-map question rather than a legal one. Firms that cannot produce a current record of processing activities discover it here, under a ninety-day clock, rather than at leisure.
Read next
The DPDP brief
One email a month. What moved in the Act, and what our scans found.
Section 11 is live. One email a month on what moved in the Act, every claim cited to its section, the same way this page is.