body or data controller party to whom the personal information has been
disclosed of those steps.
(5) The data controller shall notify a data subject, who has made a request in terms
of subsection (1), of the outcome of the request within a period of 14 days of the
making of the request.
Data controller to give effect to principles/ Accountability
28
(1) The data controller shall:
(a) ensure that the principles set out under this Act and all the measures that give
effect to the principles are complied with and
(b) have the necessary internal mechanisms in place for demonstrating such
compliance to both to data subjects and to the Commission in the exercise of its
powers.
Prohibition on processing of sensitive personal information
29
Unless specifically permitted under this Act, a data controller shall not process
sensitive personal information.
Exemption on data subject’s race
31
(1) The prohibition on processing personal information concerning a data
subject’s race shall not apply if the processing is carried out to –
(a) identify data subjects and only when this is essential for that