Processes personal data, in Togo

Loi n° 2019-014 du 29 octobre 2019 relative à la protection des données à caractère personnel, arts. 1-20, 32-34, 51-54, 75-78 and 94-97 (comprehensive regime, formalities and obligations) · Read the law's page

• Have a lawful basis for processing personal data, generally the data subject's consent, or rely on a legal obligation, a public interest task, contract performance, or safeguarding the data subject's interest or fundamental rights and freedoms.
• Declare personal data processing to the Instance de Protection des Données à Caractère Personnel before implementing it, unless the processing is exempt from formalities, requires prior authorization, or requires a reasoned government opinion.
• Obtain the Instance's prior authorization before interconnecting files that serve different purposes, processing a national identification number or other general purpose identifier, or processing personal data for a historical, statistical or scientific public interest purpose.
• Collect and process personal data lawfully and fairly, only for determined and legitimate purposes, keep it accurate and up to date, and do not retain it beyond the period necessary for those purposes.
• Choose a processor that offers sufficient guarantees, govern the engagement with a written contract confining the processor to your instructions, and keep processing confidential under the authority of persons who have signed a written confidentiality undertaking.
• Take appropriate technical and organizational measures to prevent unauthorized access to, alteration of, or loss of personal data, and keep the data usable regardless of changes in the storage technology used.
• Where you appoint a data protection correspondent to qualify for the formality exemption, notify the appointment to the Instance and have the correspondent advise on compliance, cooperate with the Instance, and keep an accessible list of the processing you carry out.

Loi n° 2019-014 du 29 octobre 2019, arts. 26, 35-50 (rights of data subjects) · Read the law's page

• Tell a data subject, at the latest when you collect their personal data directly from them, your identity, the purposes of the processing, the categories of data and recipients, whether answering is mandatory, their right to be excluded from the file, their rights of access and rectification, the retention period, and any transfer abroad you envisage.
• Answer an access request by confirming whether you process the person's data, providing it in an accessible form with its origin, purposes, categories and recipients, and any transfer abroad, and deliver a copy at no more than reproduction cost.
• Let a data subject object, on legitimate grounds, to the processing of their personal data, and tell them before their data is first disclosed to or used by a third party for prospecting, offering a free right to object to it, unless the processing meets a legal obligation.
• Correct, complete, update, lock or delete personal data on a data subject's written request within one month and at no cost, when it is inaccurate, incomplete, ambiguous, outdated or unlawfully held, and notify any third party the data was disclosed to.
• Where you have made a data subject's personal data public, take reasonable measures, including technical ones, to tell third parties processing that data to erase links to it or any copy, when the data subject asks.
• Do not send unsolicited direct marketing to a person using their personal data without their prior consent to receive it.
• Let the heirs of a deceased data subject require you to record the death and make the necessary updates, and justify doing so at no charge.

Loi n° 2019-014 du 29 octobre 2019, arts. 28-31 (cross border transfer) · Read the law's page

• Before transferring personal data to a third country, confirm that country ensures a sufficient level of protection for privacy and fundamental rights and freedoms, and inform the Instance beforehand for its reasoned opinion.
• Where the destination country does not ensure a sufficient level of protection, transfer personal data there only as a one off, non massive transfer with the data subject's express consent, or where the transfer meets one of the law's listed grounds, such as safeguarding the person's life or a contractual necessity.
• Where you cannot meet the one off transfer conditions, obtain the Instance's authorization for a transfer or set of transfers to a country lacking adequate protection, by offering sufficient guarantees for privacy, fundamental rights and freedoms and the exercise of the corresponding rights.
• Expect the Instance to verify, before any processing of personal data you receive from abroad, that you assure a sufficient level of protection for privacy and fundamental rights, judged by your security measures and the purpose, duration, nature, origin and destination of the data.

Loi n° 2019-014 du 29 octobre 2019, arts. 55-74, 79-93 (institutional framework, sanctions and offenses) · Read the law's page

• Expect the Instance de Protection des Données à Caractère Personnel to investigate complaints, petitions and claims about your processing, tell their authors the outcome, and alert the public prosecutor to any offense it learns of.
• Comply with a warning or formal notice the Instance issues within the period it sets, or face a provisional or, ultimately, definitive withdrawal of your authorization, an administrative fine of up to XOF 100,000,000, interruption of the processing, data locking, or a daily penalty of up to XOF 5,000,000, after a hearing.
• Do not obstruct the Instance's action by opposing its members' or agents' missions, refusing to communicate the information or documents they request, or supplying information that does not match your records.
• Expect criminal liability of up to five years' imprisonment and a fine of up to XOF 25,000,000 for processing without the required formalities, unauthorized use of the national identification number, fraudulent data collection, unlawful processing of sensitive or offense related data, breach of the right to object, misuse of data beyond its declared purpose, or unauthorized disclosure of data.

Loi n° 2019-014 du 29 octobre 2019, arts. 8, 21-25 (sensitive personal data) · Read the law's page

• Obtain the Instance's prior authorization before processing genetic data, health research data, biometric data, or data on criminal offenses, convictions or security measures.
• Do not collect or process data revealing racial or ethnic origin, filiation, political, religious or philosophical opinions, trade union membership, sex life, or health or genetic data, unless a listed exception applies, such as the data subject's written consent or a vital interest that prevents them from consenting.
• Process data on criminal offenses, convictions or security measures only as a court, a public authority, a body managing a public service, or a legal auxiliary acting within your legal duties.
• Process health data only on one of the law's listed grounds, keep it under the supervision of a health professional bound by professional secrecy, and collect it directly from the data subject except where collection elsewhere is necessary for the processing or the data subject cannot provide it themselves.