Sends faxes, in the Economic Community of West African States

ECOWAS Supplementary Act A/SA.1/01/10, arts. 3 to 5, 14, 20, 23 to 25, 28 to 30, 34, 35, 43 and 48, general regime · Read the law's page

• As a data controller or processor handling personal data in an ECOWAS Member State, declare the processing to the national data protection Authority, except in the cases the Act exempts, and obtain consent or another ground Article 23 lists.
• Obtain personal data only for specified, explicit and lawful purposes and do not process it further in a manner incompatible with those purposes.
• Do not obtain or process data that reveals racial, ethnic or regional origin, political opinions, religious or philosophical beliefs, trade union membership, sexual life, genetic data or health, except in a case Article 31 lists.
• Do not use an individual's personal data for direct prospecting by any means of communication without the individual's prior consent.
• Do not base a decision that has legal effect on an individual solely on automatic processing of personal data that defines the individual's profile or evaluates aspects of personality.
• Keep personal data confidential and protected, and take all necessary precautions so that it is not deformed, damaged or accessible to unauthorised third parties.
• Where processing is carried out on your behalf, choose a data processor that provides sufficient guarantees.

ECOWAS Supplementary Act A/SA.1/01/10, arts. 38 to 41, rights of the data subject · Read the law's page

• Give an individual whose personal data you process, no later than at the time of collection, the information Article 38 lists, including the purposes, the recipients, the period of preservation and any possible transfer to a third country.
• Answer an individual's request for confirmation that the individual's data is or is not being processed, and for disclosure of the data and any available information about its origin.
• Honor an individual's objection, for legitimate reasons, to the processing of the individual's personal data.
• Before disclosing an individual's data for the first time to a third party, or using it for a third party's prospecting, inform the individual and give the individual an express, free right to object.
• Rectify, supplement, update, block or destroy inaccurate, incomplete, questionable, outdated or prohibited personal data when the individual asks.