Protection of Personal Information Act - Section 23
"A data subject, having provided adequate proof of identity, has the right to—
- request a responsible party to confirm, free of charge, whether or not the responsible party holds personal information about the data subject; and
- request from a responsible party the record or a description of the personal information about the data subject held by the responsible party, including information about the identity of all third parties, or categories of third parties, who have, or have had, access to the information."
Do you have adequate procedures for data subjects to participate in the processing of their personal information?