You may request access to your personal data held by an organisation. However, there are exceptions such as legal professional privilege information and opinion data kept solely for evaluative purpose, among others. You may refer to the Fifth Schedule in the PDPA for the list of exceptions from the access requirement.

In addition, organisations are prohibited from providing you access to the personal data if:

• it causes immediate or grave harm to your safety or physical or mental health;
• it threatens the safety or physical or mental health of another individual;
• it reveals personal data about another individual;
• it reveals the identity of the individual who has provided the personal data about you, and the individual has not consented to the disclosure of his or her identity; or
• it is contrary to national interest.

Organisations may charge a reasonable fee for access to personal data about an individual, to allow them to recover the incremental costs of responding to the access request. An example of such incremental cost is the cost of producing a physical copy of the personal data for an individual requesting it.

As organisations are required to make the necessary arrangements to provide for standard types of access requests, the costs incurred in capital purchases (for example, purchasing new equipment to provide access to the requested personal data) should not be transferred to individuals. The fee should also accurately reflect the time and effort required to respond to the request.

You may request to correct an error or omission in the personal data an organisation holds about you. An organisation need not make a correction where it is satisfied on reasonable grounds that a correction should not be made. In this case, the organisation shall annotate the personal data in its possession or under its control with the correction that is requested but not made.

The organisation is generally required to send the corrected personal data to every other organisation to which the personal data was disclosed to within a year before the correction, unless the other organisation does not need the corrected personal data for any legal or business purpose, or if you have consented to the sending of corrected data only to specific organisations.

There are also exceptions to the correction requirement, such as if the personal data is opinion data kept solely for evaluative purposes. The list of exceptions may be found in the Sixth Schedule of the PDPA.

Organisations are not entitled to impose a fee for the correction of personal data as required under the PDPA.