Act
Data Protection And Pri vacy Act
2019
(2) The Authority shall determine and notify the data controller ,
data collector or data processor whether the data controller, data
collector or data processor should notify the data subject of the
breach.
(3) Where the Authority determines that the data collector, data
processor or data controller should notify the data subject, the
notification shall be made by(a) registered mail to the data subject's last known residential
or postal address;
(b) electronic mail to the data subject's last known electronic
mail address;
(c) placement in a prominent position on the website of the
responsible party; or
(d) publication in the mass media.
(4) A notification referred to in sub section (3) shall provide
sufficient information relating to the breach to allow the data subject
to take protective measures against the consequences of unauthorised
access or acquisition of the data.
(5) Where the Authority has grounds to believe that publicity
would protect a data subject who is affected by the unauthorised
access or acquisition of data, the Authority shall direct the responsible
party to publicise in the specified manner, the fact of the compromise
to the integrity or confidentiality of the personal data.
PART V-RIGHTS
OF DATA SLBJECTS
24. Right to access personal information
(1) A data subject who provides proof of identity may request a
data controller to-