Chapter 3 · Rights & Duties of Data Principal
Section 11 - Right to access information about personal data
Know what is processed and with whom it is sharedThis is your right to ask a Fiduciary what it is doing with your data.
Download full Act (PDF)In plain English
This is your right to ask a Fiduciary what it is doing with your data. On request, it must give you a summary of the personal data it processes about you and the processing it carries out, plus the identities of everyone it has shared your data with and a description of what was shared. There is one carve-out: it need not reveal sharing done with authorised bodies for preventing, detecting or investigating offences.
You can ask an e-commerce site which delivery, payment and analytics partners received your address and order details.
Key points
- Request a summary of your personal data and how it is being processed.
- Learn the identities of other Fiduciaries and Processors it was shared with, and what was shared.
- Applies to data you consented to (including certain legitimate-use data).
- Sharing for offence prevention or investigation is exempt from disclosure.
Official section text
Section 11. Right to access information about personal data.
The Data Principal shall have the right to obtain from the Data Fiduciary to whom she has previously given consent, including consent as referred to in clause (a) of section 7 (hereinafter referred to as the said Data Fiduciary), for processing of personal data, upon making to it a request in such manner as may be prescribed, -
a summary of personal data which is being processed by such Data Fiduciary and the processing activities undertaken by that Data Fiduciary with respect to such personal data;
the identities of all other Data Fiduciaries and Data Processors with whom the personal data has been shared by such Data Fiduciary, along with a description of the personal data so shared; and
any other information related to the personal data of such Data Principal and its processing, as may be prescribed.
Nothing contained in clause (b) or clause (c) of sub-section (1) shall apply in respect of the sharing of any personal data by the said Data Fiduciary with any other Data Fiduciary authorised by law to obtain such personal data, where such sharing is pursuant to a request made in writing by such other Data Fiduciary for the purpose of prevention or detection or investigation of offences or cyber incidents, or for prosecution or punishment of offences.