Data controllers are subject to the following principles and requirements:

The obligations of data controllers include:

• Transparency: Data Controllers must inform the Data Subjects about the processing and personal data processed.
• Security: Data Controllers are required to ensure the security of personal data. They must prevent the data’s alteration and damage, or access by non-authorised third parties.
• Confidentiality: The Data Controller must ensure confidentiality and security of the processing.

(Articles 34 and 35 of the Act)

The Data holders/subjects have rights to:

• Access and obtain the following from the Data Controller: Information which they are entitled to know, and which will allow them to contest the processing, confirmation of whether their personal data forms part of the processing, a copy of their personal data (in an accessible form), as well as any available information on the data’s origin and information relating to the purposes of the processing and categories of processed data; recipients or categories of recipients to whom the data are disclosed; and transfer of personal data outside the country.
• Request that the Data Controller rectify or delete their personal data if they are inaccurate, incomplete, unclear, or expired, or if the collection, usage, disclosure, or retention of the data is prohibited.
• Object to the processing on legitimate grounds including for marketing purpose unless the processing satisfies a legal obligation.
• Complain to the CDP at any time the processing of their Personal Data does not comply with Data Protection Act

(Articles 33, 62, 63 and 69 of the Act)