Reproduced by Sabinet Online in terms of Government Printer’s Copyright Authority No. 10505 dated 02 February 1998 20 No. 37067 GOVERNMENT GAZETTE, 26 November 2013 Act No. 4 of 2013 Protection of Personal Information Act, 2013 20 case, subject to section 37, the conditions for the lawful processing of personal information as referred to in Chapter 3 must be complied with. (6) The conditions for the lawful processing of personal information by or for a responsible party for the purpose of direct marketing by any means are reflected in Chapter 3, read with section 69 insofar as that section relates to direct marketing by 5 means of unsolicited electronic communications. (7) Sections 60 to 68 provide for the development, in appropriate circumstances, of codes of conduct for purposes of clarifying how the conditions referred to in subsection (1), subject to any exemptions which may have been granted in terms of section 37, are to be applied, or are to be complied with within a particular sector. 10 Rights of data subjects 5. A data subject has the right to have his, her or its personal information processed in accordance with the conditions for the lawful processing of personal information as referred to in Chapter 3, including the right— (a) to be notified that— (i) personal information about him, her or it is being collected as provided for in terms of section 18; or (ii) his, her or its personal information has been accessed or acquired by an unauthorised person as provided for in terms of section 22; (b) to establish whether a responsible party holds personal information of that data subject and to request access to his, her or its personal information as provided for in terms of section 23; (c) to request, where necessary, the correction, destruction or deletion of his, her or its personal information as provided for in terms of section 24; (d) to object, on reasonable grounds relating to his, her or its particular situation to the processing of his, her or its personal information as provided for in terms of section 11(3)(a); (e) to object to the processing of his, her or its personal information— (i) at any time for purposes of direct marketing in terms of section 11(3)(b); or (ii) in terms of section 69(3)(c); (f) not to have his, her or its personal information processed for purposes of direct marketing by means of unsolicited electronic communications except as referred to in section 69(1); (g) not to be subject, under certain circumstances, to a decision which is based solely on the basis of the automated processing of his, her or its personal information intended to provide a profile of such person as provided for in terms of section 71; (h) to submit a complaint to the Regulator regarding the alleged interference with the protection of the personal information of any data subject or to submit a complaint to the Regulator in respect of a determination of an adjudicator as provided for in terms of section 74; and (i) to institute civil proceedings regarding the alleged interference with the protection of his, her or its personal information as provided for in section 99. Exclusions 15 20 25 30 35 40 45 6. (1) This Act does not apply to the processing of personal information— (a) in the course of a purely personal or household activity; (b) that has been de-identified to the extent that it cannot be re-identified again; (c) by or on behalf of a public body— (i) which involves national security, including activities that are aimed at 50 assisting in the identification of the financing of terrorist and related activities, defence or public safety; or