TABLE OF CONTENTS

1. INTRODUCTION.. 2
2. PURPOSES OF THE GUIDELINE.. 2
3. SCOPE OF THIS GUIDELINE.. 2
4. ROLES AND RESPONSIBILITIES. 2
5. RIGHTS OF DATA SUBJECTS. 3
6. RECEIVING AND LOGGING REQUESTS. 4
7. VERIFICATION OF IDENTITY.. 5
8. EVALUATION AND RESPONSE.. 5
9. IDENTIFYING AND LOCATING PERSONAL DATA.. 5
10. GENERAL REASONS FOR DENYING A DATA SUBJECT’S REQUEST.. 6

SCHEDULE 1 – REQUEST FOR ACCESS TO PERSONAL DATA.. 7

SCHEDULE 2 – REQUEST FOR RECTIFICATION TO PERSONAL DATA.. 9

SCHEDULE 3 – REQUEST FOR ERASURE OF PERSONAL DATA FORM… 11

SCHEDULE 4 – REQUEST FOR RESTRICTION OR OBJECTION TO THE PROCESSING OF PERSONAL INFORMATION.. 13

SCHEDULE 5 – DATA PORTABILITY REQUEST FORM… 14

SCHEDULE 6: TIMELINES FOR RESPONDING TO DATA SUBJECT REQUESTS. 15

 

 

 

 

1.     INTRODUCTION

• NAS is committed to upholding the rights of individuals whose personal data it processes.
• This Guideline provides a consistent framework for all departments to receive, verify, evaluate, and respond to data subject rights (DSR) requests in a lawful, transparent, and timely manner, in line with the Data Protection Act, 2019 and NAS’s Data Protection Policy.

2.     PURPOSES OF THE GUIDELINE

• This Guideline aims to:
• Ensure all data subject requests are handled fairly, consistently, and within statutory timelines.
• protect the rights and privacy of individuals while balancing NAS’s legal and operational obligations.
• promote accountability by documenting the handling of each request; and
• support compliance with regulatory requirements under the Office of the Data Protection Commissioner (ODPC).

3.     SCOPE OF THIS GUIDELINE

• This Guideline applies to all departments and all NAS staff and contractors, including permanent, fixed-term and temporary, outsourced employees, consultants, interns and any third-party representatives involved in data processing activities.

4.     ROLES AND RESPONSIBILITIES

• Department Heads: Ensure that requests are handled promptly and in accordance with this Guideline and maintain proper documentation.
• Data Protection Officer (DPO): Provides oversight, guidance, and approval on complex or high-risk requests, and liaises with the ODPC where required.
• Employees: Promptly report and record all data subject requests received in their departments and cooperate fully in locating and verifying relevant data.

5.     RIGHTS OF DATA SUBJECTS

• Under the Data Protection Act, 2019, individuals whose personal data is processed by NAS are entitled to exercise specific rights that promote fairness, transparency and accountability in data handling.
• All employees must understand these rights to ensure that any requests received are handled lawfully, efficiently and in a manner that upholds the privacy and dignity of the data subject.
• The table below outlines the key data subject rights and provides practical examples of how each right may apply in NAS’s operations.

Right	Description of Right	Examples in Practice
Right to Information	Right to be informed of the collection and use of personal data.	An employee is provided with a Privacy Notice explaining how their biometric data is used and who has access to it
Right of Access	Right to obtain confirmation of whether their personal data is being processed and access to that data.	An employee requests for a copy of all their employment records, including their performance appraisals and disciplinary records.
Right to Rectification	Right to request correction of inaccurate or incomplete data.	An individual updates an incorrect phone number or email address in their file/contract records.
Right to Erasure (“Right to be Forgotten”)	Right to request deletion of their data in specific circumstances.	A job applicant withdraws their application and asks NAS to delete their CV and supporting documents.
Right to Restrict Processing	Right to request limitation of how their data is used in certain situations.	An individual supplier asks NAS to suspend use of their data pending verification of a disputed payment.
Right to Data Portability	Right to receive their personal data in a structured, machine-readable format and transmit it to another controller.	A former employee requests a digital copy of their employment and training records to be transferred to a new employer
Right to Object	Right to object to processing of their personal data, including for direct marketing.	A model withdraws their consent for the use of their personal data for marketing purposes
Right Against Automated Decision-Making	Right to object to decisions made solely through automated processing that significantly affect them.	An employee requests to understand how your system automatically assigns shift schedules and whether any human review occurs.

6.     RECEIVING AND LOGGING REQUESTS

• Data subject requests may be submitted through any of NAS’s official channels, including:
• Email or postal correspondence
• Telephone or in-person requests at any NAS office
• NAS’s official website via the designated Data Subject Rights Request Form or web submission portal; or
• Official social media platforms managed by NAS.
• Data subjects shall be encouraged to submit their requests in writing to facilitate accurate recordkeeping, tracking, and verification of requests. Samples of Data Subject Request Forms, including the formats prescribed under the Data Protection (General) Regulations, 2021, are provided in Appendix 1 of this Guideline for reference and use by departments and data subjects. The forms are also available on the website.
• Where a verbal request is received, the receiving officer shall assist the data subject to complete the appropriate form or create a written record of the request for signature or confirmation by the data subject.
• All requests shall be immediately recorded in the Data Subject Request Log maintained by the receiving department or automatically captured via the web submission portal.
• The log shall include:
• Requester’s name and contact details
• Date and mode of receipt
• Type of right exercised
• Department handling the request
• Verification status
• Action taken and completion date.
• Each request shall be assigned a unique reference number for tracking and audit purposes.
• The log shall be reviewed monthly by the Data Protection Officer (DPO) to ensure compliance with statutory timelines and proper documentation.

7.      VERIFICATION OF IDENTITY

• The department shall verify the requester’s identity before processing any request, using valid identification or existing account information.
• If the request is submitted through an authorised representative, written authorisation and proof of identity of both parties must be obtained.
• If identity cannot be verified, the request shall not proceed until adequate proof is provided.

8.      EVALUATION AND RESPONSE

• The receiving department shall assess whether the request is valid, complete, and falls within NAS’s processing scope.
• Complex or cross-departmental requests must be referred to the DPO for guidance.
• Unless otherwise directed by the DPO, responses must be provided within seven (7) days.
• Where more time is required due to complexity, the requester must be informed of the reason for the delay and expected completion date.

9.     IDENTIFYING AND LOCATING PERSONAL DATA

• Each department shall assist in locating the personal data relevant to the request from all applicable systems, archives, and third-party processors.
• The Records Officer and IT Department shall support the retrieval of both physical and electronic records.
• A record of all systems and locations searched must be maintained for accountability.

10.   GENERAL REASONS FOR DENYING A DATA SUBJECT’S REQUEST

• A request may be declined, in full or in part, where:
• The requester’s identity cannot be verified
• The data requested does not exist or cannot reasonably be located
• Disclosure would infringe the rights and freedoms of another individual
• The request is manifestly unfounded, excessive, or repetitive
• Processing is restricted by law or ongoing legal proceedings; or
• The data is retained solely for archiving, statistical, or research purposes where erasure would seriously impair such objectives.
• All data request refusals must be documented and approved by the DPO, stating the legal basis for the decision.

SCHEDULE 1 – REQUEST FOR ACCESS TO PERSONAL DATA

Note:

(i) Documentary evidence in support of this request may be required.

(ii) Where the space provided for in this Form is inadequate, submit information as an

annexure

(iii) All fields marked as * are mandatory

1. DETAILS OF THE DATA SUBJECT

(This section is to provide the details of the Data Subject)

Name*:  ………………………………………………………………………….

Identity Number*:……………………………………………………………….

Phone number*: ……………………………………………………………………

e-mail address: ……………………………………………………………………….

(Provide the following details where making a request on behalf of a minor or a person

who has no capacity)

 Name*:…………………………………………………………………………..…

Relationship with the Data Subject*: ………………………………………………. …..

Contact Information*: ………………………………………………………………………

1. DETAILS OF THE PERSONAL DATA REQUESTED

(Describe the Personal Data requested)

 

MODE OF ACCESS

I would like to: (check all that apply)

[ ] Inspect the record

[ ] Listen to the record

[ ] Have a copy of the record made available to me in the following format:

[ ] photocopy (Please note that copying costs will apply)

number of copies required: ……………………………….

[ ] electronic

[ ] transcript (Please note that transcription charges may apply)

[ ] Other (specify) ………………………………………………………………..

1. DELIVERY METHOD

[ ] collection in person

[ ] by mail (provide address where different / in addition to details provided above)

Town/City: …………………………………………………………………………………………

[ ] by e-mail (provide email address where different / in addition to details provided above): ……………………………………………………………………………

 

DECLARATION

Note any attempt to access Personal Data through misrepresentation may result in

prosecution.

I certify that the information given in this application is true.

 

Signature                                                        Date

 

 

 

 

 

 

 

 

 

 

 

 

SCHEDULE 2 – REQUEST FOR RECTIFICATION TO PERSONAL DATA

Fill as appropriate

Note:

1. Documentary evidence in support of this request may be required.
2. Where the space provided for in this Form is inadequate, submit information as an annexure

• All fields marked as * are mandatory

1.  DETAILS OF THE DATA SUBJECT

(This section is to provide the details of the Data Subject).

Name*:

Identity Number*: ……………………………………………………

Phone number*: ………………………………………………………

e-mail address: ………………………………………………………….

(Provide the following details where making a request on behalf of a minor or a person

who has no capacity)

Name* : …………………………………………………………………..

Relationship with the Data Subject*: ………………………………………….

Contact Information*: ……………………………………………………………

Signature                                                                          Date

 

Section 3: PROPOSED CHANGE(S)

 

S/NO	Personal Information currently on the file to be corrected e.g., name, residential status, mobile number, email address.	The proposed change	Reason for the proposed change
1.
2.
3.
4.
5.
6.

 

 B: DECLARATION

Note any attempt to rectify Personal Data through misrepresentation may result in prosecution

I confirm that I have read and understood the terms of this request form and certify that the information given in this application is true.

 

 

Signature                                                                             Date                  Date

 

 

 

 

 

 

 

 

 

SCHEDULE 3 – REQUEST FOR ERASURE OF PERSONAL DATA FORM

Fill as appropriate

Note:

1. Documentary evidence in support of this request may be required.
2. Where the space provided for in this Form is inadequate, submit information as an annexure

• All fields marked as * are mandatory

1. DETAILS OF THE DATA SUBJECT

(This section is to provide the details of the Data Subject).

Name*: ………………………………………………………………………………………………………………….

Identity Number*: ………………………………………………………………………………………………….

Phone number*: ……………………………………………………………………………………………………..

e-mail address: ……………………………………………………………………………………………………….

 (Provide the following details where making a request on behalf of a minor or a person

who has no capacity)

Name* ………………………………………………………………………………………………………………….

Relationship with the Data Subject* …………………………………………………………………………

Contact Information* ………………………………………………………………………………………………

1. REASON FOR ERASURE REQUEST

(Tick the appropriate box)

Your Personal Data is no longer necessary for the purpose for which it was originally collected;
You have withdrawn consent that was the lawful basis for retaining the Personal Data;
You object to the Processing of your Personal Data and there is no overriding legitimate interest to continue the Processing;
The Processing of your Personal Data has been unlawful
Required to comply with a legal obligation.

 

PERSONAL DATA TO BE ERASED

 

Describe the Personal Data you wish to have erased.

 

SCHEDULE 4 – REQUEST FOR RESTRICTION OR OBJECTION TO THE PROCESSING OF PERSONAL INFORMATION

Note

1.  Documentary evidence in support of the objection may be required.
2. Where the space provided for in this Form is inadequate, submit information as an

Annexure

1. NATURE OF REQUEST

Mark the appropriate box with an “x”. Request for:

RESTRICTION                                                       OBJECTION

1. DETAILS OF THE DATA SUBJECT

Name: ……………………………………………………………………………………………………………………

Identity Number: ……………………………………………………………………………………………………

Phone number: ………………………………………………………………………………………………………..

E-mail address: ………………………………………………………………………………………………………

 

(Your details below where initiating the request for a minor or a person who has no

capacity)

Name ……………………………………………………………………………………………………………………

Relationship with the Data Subject …………………………………………………………

Contact Information: …………………………………………………………………………

1. REASONS FOR THE REQUEST

(Please provide detailed reasons for the restriction or objection)

  

1. DECLARATION

I certify that the information given in this application is true

 

Signature                                                                               Date

 SCHEDULE 5 – DATA PORTABILITY REQUEST FORM

Note:

1. Documentary evidence in support of this request may be required.
2. Where the space provided for in this Form is inadequate, submit information as an annexure

• All fields marked as * are mandatory

 DETAILS OF THE DATA SUBJECT

(This section is to provide the details of the Data Subject).

Name*: …………………………………………………………………….

Identity Number*: ………………………………………………………….

Phone number*: …………………………………………………………….

e-mail address: ………………………………………………………………

 

(Provide the following details when making a request on behalf of a minor or a person

who has no capacity)

Name*: …………………………………………………………………………

Relationship with the Data Subject*: ………………………………………….

Contact Information*:……………………………………………………….

 

1. DETAILS OF THE REQUEST

Please transfer a copy of my Personal Data to * …………………………………………….

By either:

• Emailing a copy to them at …………………………………………………………
• Mailing to:………………………………………………………………………..
• Others (Please specify) …………………………………………………………….

 

DECLARATION

Note, any attempt to port Personal Data through misrepresentation may result in

prosecution.

I certify that the information given in this application is accurate to the best of

my knowledge

Signature                                                                               Date

SCHEDULE 6: TIMELINES FOR RESPONDING TO DATA SUBJECT REQUESTS

Right	Response Timeline	Response timeline where request is declined
Right to Access	7 days	None provided in law
Right to Rectification	14 days	7 days
Right to Erasure	14 days	None provided in law
Right to Restrict Processing	14 days	14 days of the refusal
Right to Data Portability	30 days	7 days
Right to Object	14 days	7 days