(3) A data subject shall have a right to challenge the written reasons for denail or
requests made in terms of subsection (1).
(4) If, in accordance with subsection (1) (b), personal information is communicated
to a data subject, the data subject shall be advised of the right in terms of section
27 to challenge the correctness of the information.
Correction of personal information
27.
(1) A data subject shall free of charge have a right to challenge the correctness of
information by requesting that a data controller (a) correct or delete personal information about the data subject in its
possession or under its control that is innacurate, irrelevant,
excessive, out of date, incomplete, misleading or obtained
unlawfully; or
(b) destroy or delete a record of personal information about the data
subject that the data controller is no longer authorised to retain.
(2) A data controller shall, on receipt of a request in terms of subsection (1), take
reasonable steps to investigate the challenge lodged and –
(a) correct, destroy or delete the information; or
(b) provide that data subject, with credible evidence in support of the
correctness of the information.
(3) Where credible evidence has been provided under subsection (2) (b), the data
subject may apply to the Commission to investigate the disputed information.
(4) Where the data controller has taken steps under subsection (2)(a) that result in
a change to the information and the changed information has an impact on
decisions that have been or will be taken in respect of the data subject in
question, the data controller shall, within 7 working days, inform each person of