Under PDPA, individuals can request for access to their personal data, request for information on how the data is being used and correct any error or omission where required.Answer: True False

Which of the description best matches the PDPA obligation for Access and Correction?Choose one of the following answers. Notify individuals of the purposes for collecting, using and disclosing their personal data, including step-by-step procedures should there be a data breach. Allow individuals to withdraw their consent with reasonable notice or transmit their personal data in your possession to another organization.  Allow individual to access information on how their personal data are used within a year, and correct errors where required.  Ensure that the personal data collected is accurate and complete especially if it will be disclosed to another organization.

If you are requesting for data from a colleague or a client, what do you absolutely have to include in your request?A description of the data you need, the units of measure for each, and the time period for eachYour full data analysis planThe person who gave you permission to access the data

Which of the PDPA obligations best matches the following description? Dispose data properly when it is no longer needed for business or legal purpose. Choose one of the following answers. Purpose Limitation Protection Consent Transfer Limitation Data Portability Retention Limitation

The Data Protection Act (DPA) is a law that protects personal data from being misusedExamples of personal data would includeNameAddressDate of BirthRaceReligion

The EU General Data Protection Regulation contains (in Article 17) the right for a data subject to obtain from a controller erasure of her or his personal data. That means that if personal data are: (a) no longer necessary for the purpose for which they were collected, or (b) the data subject withdraws consent that had been given to the processing of data, or (c) the data subject objects to the processing (for example, processing her or his personal data for direct marketing purposes, or processing her or his personal data where there are no longer legitimate grounds that override her or his interests, rights and freedoms), or (d) the data subject is a child and personal data have been collected to offer online services to that child, the controller has the obligation to erase data subject’s personal data. Does the New Zealand Privacy Act 2020 offer individuals similar entitlements? Explain how an individual could claim under the Privacy Act 2020 the entitlement to erase her or his personal information held by the agency in those situations?