Debated in Parliament on 5 May 2026.
Dr Hamid Razak asked the Minister for Digital Development and Information how the Ministry ensures that the timelines for responding to personal data access requests under the Personal Data Protection Act 2012 are aligned with typical data retention practices so that individuals are able to meaningfully exercise their access rights.
The Personal Data Protection Act requires organisations to respond to personal data access requests as soon as reasonably practicable. If the organisation is unable to provide the requested personal data within 30 days after receiving the request, the organisation must within that time inform the individual in writing of when it will respond to the request. Organisations must also implement policies and practices to handle access requests, which include having appropriate measures to preserve the requested personal data while the request is being processed.
PAPERCUTS