Processes personal data, in Chad

Loi n°007/PR/2015 du 10 février 2015, art. 61 · Read the law's page

• Notify both ANSICE and the affected data subject, without delay, of any security breach affecting that person's personal data.

Loi n°007/PR/2015 du 10 février 2015, arts. 1-15 · Read the law's page

• Process personal data only with the data subject's consent, or, absent consent, only when indispensable to a legal obligation, a public-interest mission, a contract with the data subject, or safeguarding the data subject's interest or fundamental rights and freedoms.
• Collect and process personal data only for determined, explicit, and legitimate purposes, and do not process it later in a way incompatible with those purposes.
• Keep personal data accurate and up to date, and retain it no longer than the purpose for which it was collected requires.
• Inform the data subject about the processing of their personal data, and process it confidentially and with security measures against unauthorized access.

Loi n°007/PR/2015 du 10 février 2015, arts. 16-25 · Read the law's page

• Do not process biometric data, or data revealing racial or ethnic origin, filiation, political opinion, religious or philosophical belief, trade-union membership, sex, health, or sexual life, unless the data subject gives explicit written consent or a listed statutory exception applies.
• Where processing genetic data or data revealing health-related secrets, use a unique patient identifier distinct from other identification numbers, and interconnect it with another identifying number only with ANSICE's express authorization.
• Process a minor's personal data only in keeping with the representation rules the law sets for the exercise of the minor's own rights.

Loi n°007/PR/2015 du 10 février 2015, arts. 29-32 · Read the law's page

• Do not transfer personal data to a country outside the CEMAC and CEEAC blocs unless that country ensures a sufficient level of protection for privacy and fundamental rights and freedoms.
• Before any transfer of personal data to a country outside the CEMAC and CEEAC blocs, inform ANSICE in advance.
• Where the destination country does not ensure a sufficient level of protection, transfer personal data only on the data subject's unambiguous consent, another article 31 ground, or ANSICE's authorization on the strength of sufficient contractual safeguards.

Loi n°007/PR/2015 du 10 février 2015, arts. 35-50 · Read the law's page

• At the point of collecting personal data, provide the data subject the controller's identity, the processing purposes, the data categories, the recipients, the retention period, and any prospect of transfer to a third country.
• On a data subject's request, confirm whether their data is processed, communicate that data and its origin, purposes, legal basis, categories, and recipients, and provide a copy at no more than reproduction cost, free of the request itself.
• Honor a data subject's objection, made on legitimate grounds, to processing of their personal data, including before first communicating it to a third party or using it for prospecting.
• Within one month of a written request, rectify, complete, update, block, or erase personal data that is inaccurate, incomplete, equivocal, outdated, or unlawfully held.

Loi n°007/PR/2015 du 10 février 2015, arts. 80-94 · Read the law's page

• Comply with an ANSICE warning or formal notice to cease a failure within the period ANSICE sets, on pain of a regulatory penalty and, for the underlying violation, criminal prosecution.
• Meet the collection, purpose-limitation, sensitive-category, information, access-response, notification, declaration, and cross-border transfer conditions the law sets, each of which carries its own criminal exposure on breach.
• Do not obstruct ANSICE, its members, or the experts it requires in exercising their verification powers.
• Compensate a person harmed by unlawful processing or any act inconsistent with the law, unless the harmful act is proven not attributable to the controller.