Skip to main content
 
Cybersecurity

You Have a Legal Right to Ask Any Company What Personal Data It Holds on You

Under POPIA, anyone can submit a formal "subject access request" asking a company what personal information it holds, where it came from, and who it's been shared with — and the organisation is legally required to respond through its registered Information Officer.

Most South Africans have never used this right, largely because they don't know it exists — yet it applies to banks, retailers, insurers, employers and virtually any business keeping customer or staff records. Ignoring or unreasonably refusing a request can result in a formal complaint to the Information Regulator.

Source: Protection of Personal Information Act 4 of 2013

Frequently Asked Questions

Does a company have to give me the information for free?

POPIA allows a "reasonable fee" in some cases, but the request itself cannot be refused arbitrarily.

What can I do if a company ignores my request?

You can lodge a formal complaint with the Information Regulator, which has the power to investigate and issue enforcement notices.

Does this right also let me ask a company to delete my data?

Yes, in certain circumstances — POPIA also gives you the right to request correction or deletion of inaccurate or unlawfully processed personal information.

← More Did You Know facts