supplemented, erased or destroyed, the data controller is required to
notify third parties to whom the data has been previously disclosed of
the rectification, blocking, supplementation, erasure or destruction.
(5) To determine whether it is reasonably practicable to require the
notification, the Commission shall have regard, in particular, to the number of
persons to be notified.
Application of the Act
45. (1) Except as otherwise provided, this Act applies to a data control- ler in
respect of data where
(a) the data controller is established in this country and the data is
processed in this country,
(b) the data controller is not established in this country but uses
equipment or a data processor carrying on business in this country
to process the data, or
(c) processing is in respect of information which originates partly or
wholly from this country.
(2) A data controller who is not incorporated in this country shall register
as an external company.
(3) For the purposes of this Act the following are to be treated as
established in this country:
(a) an individual who is ordinarily resident in this country;
(b) a body incorporated under the laws of this country;
(c) a partnership, persons registered under the Registration of Business
Names Act, 1962 (Act 151) and the Trustees (Incorporation) Act,
1962 (Act 106);
(d) an unincorporated joint venture or association operating in part or
in whole in this country; and
(e) any person who does not fall within paragraphs (a),(b), (c) or (d) but
maintains an office, branch or agency through which business
activities are carried out in this country.
(4) This Act does not apply to data which originates externally and merely
transits through this country.
Data Protection Register
Establishment of Data Protection Register
46. (1) There is established by this Act a register of data controllers to be
known as the Data Protection Register.
(2) The Commission shall keep and maintain the Register.