The right of access: who has what on me?
Section 23(1) gives every data subject — natural or juristic — two entitlements against any responsible party: confirmation, free of charge, of whether you hold personal information about them; and the record or a description of it, including the identity of all third parties who have had access to it, within a reasonable time, at a prescribed fee if any, and in a reasonable format. The request comes in on (or substantially similar to) Form 2 under the Regulations — and since April 2025, by hand, post, email, SMS or WhatsApp.
Correction and deletion: section 24
The grounds are specific — and they are quality grounds, not a veto:
“inaccurate, irrelevant, excessive, out of date, incomplete, misleading or obtained unlawfully”
A data subject may demand correction or deletion of information matching that list, or destruction of a record you are no longer authorised to retain. What the section does not create is a general “right to be forgotten” that overrides your lawful retention — tax records, contractual records and litigation holds survive a deletion demand. Where you and the data subject disagree about accuracy and neither yields, the Act lets the person require you to attach their correction request to the record, so every future reader sees the dispute.
The quality duty behind the rights
“A responsible party must take reasonably practicable steps to ensure that the personal information is complete, accurate, not misleading and updated where necessary.”
Section 16 is the standing duty that section 24 lets data subjects enforce. It is also — not a ban — what disciplines employee references: the reference may be given; it must be accurate, relevant and not misleading.
Handling requests in practice
Build one pipeline and route everything through it: receive on every channel the Regulations now recognise (your staff must recognise a WhatsApp message as a Form 2 request); verify identity; locate the records (your retention schedule determines how painful this is); decide — supply, correct, delete, or decline with reasons on the statutory grounds; and respond in writing within 30 days of the outcome, telling the person what was done. The information officer owns the pipeline — dealing with requests is one of the statutory duties of the role.