The Act applies to the State, but with notified exemptions; where they do not apply, the full duties hold.
In short
Government bodies and PSUs process personal data at population scale. The Act applies to the State, subject to notified exemptions for specified functions such as security and certain services. Where an exemption does not apply, the full duties of lawful processing, security, rights and breach handling hold.
The obligations that shape compliance in this sector.
The Act binds the State, but Section 17 allows notified exemptions for specified functions.
Processing for subsidies, benefits and services can rely on the Act legitimate-use grounds.
Protect citizen data with strong safeguards and least-privilege access.
Where not exempt, citizens can access, correct and seek erasure of their data.
Use citizen data only for the service it was collected for.
Handle and report breaches of citizen data appropriately.
Each sub-sector has its own data flows and its own version of the rules.
Wherever you are, start there and move through to a certifiable posture.
Run the free readiness check for a sector-specific gap report.
Take the readiness check →