Personal data access rights require disclosure of processing and sharing, subject to exceptions for authorised offence and cyber-incident investigations.

A Data Principal may, through a prescribed request, obtain from a consenting Data Fiduciary a summary of personal data processed, related processing activities, and further prescribed information. The Data Principal may also obtain identities of recipients with whom data was shared and a description of the shared data. Recipient-disclosure obligations are excluded for legally authorised sharing pursuant to written requests concerning prevention, detection or investigation of offences or cyber incidents, or prosecution or punishment of offences.

---

---

---