s 28M Application of sections 21 and 22 of Personal Data Protection Act 2012
28M. Sections 21 and 22 of the Personal Data Protection Act 2012 do not apply to a prescribed financial institution in relation to any personal data about an individual that is in the possession or under the control of the prescribed financial institution if —(a) the personal data was risk information received by the prescribed financial institution under section 28D or 28E, including any correction to such risk information; or (b) the personal data was risk information accessed by the prescribed financial institution under section 28F, including any correction to such risk information.[Act 19 of 2023 wef 01/04/2024]