11.

(1) Pursuant to section 38 of the Act, a data subject may apply to port or copy their personal data from one data controller or data processor to another.

(2) A request for data portability may be made in Form DPG 4set out in the First Schedule.

(3) A data controller or data processor shall within thirty days of the request and upon payment of the prescribed fees port personal data to the data subject’s choice of recipient.

(4) Where fee is charged under sub-regulation (2), the fee shall be reasonable and not exceed the cost incurred to actualize the request.

(5) A data controller or data processor who receives personal data that has been ported shall, with respect to such data, comply with the requirement of the Act and these Regulations.

(6) Where a data controller or data processor declines the portability request, a data controller or data processor shall, within seven days, notify the data subject of the decline and the reasons for such decline in writing.

(7) The exercise of the right to data portability by a data subject shall not negate the rights of a data subject provided under the Act.