Law / 
Central African Republic
Loi n° 24.001 portant protection des données à caractère personnel, droits liés au traitement
In force since .
A data subject rights rule binding public and private bodies.
- Obligation class
- Data subject rights, Disclosure, Access restriction
- Audit expectation
- none
What it requires
- Get a person's prior consent before contacting them with direct marketing by phone, fax, SMS, email, instant message, or social network, and let them unsubscribe or change their preferences at any time.NIST Privacy FrameworkCT.PO-P1NIST Privacy FrameworkCT.PO-P3
- Give every marketing communication, including one sent to a business or a professional contact, a notice and an unsubscribe mechanism as simple and effective as the original sign up.NIST Privacy FrameworkCT.PO-P3
- On request, give a person access to their data and to information about how any automated decision producing legal effects for them was reached, so they can understand and contest it.NIST Privacy FrameworkCT.DM-P1NIST Privacy FrameworkCM.AW-P3
- Let a person object, at any time and free of charge, to processing of their data where they show a legitimate reason, and answer an access request free of charge, on the spot or remotely, without delay, handing over a copy of the data on request.NIST Privacy FrameworkCT.PO-P3
- Correct, complete, update, block, or erase personal data on a substantiated request where it is inaccurate, incomplete, ambiguous, outdated, or unlawfully processed, and notify any third party you disclosed it to of the change without delay.NIST Privacy FrameworkCT.PO-P3NIST Privacy FrameworkCM.AW-P5
- You may refuse a manifestly abusive, repeated, or systematic request, but carry the burden of proving the abuse if the person disputes your refusal.
- Where a request concerns data processed for State security, defense, or public safety, expect the data protection agency, not the data subject directly, to route the access or rectification request.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MEASURE 2.9The AI model is explained, validated, and documented, and AI system output is interpreted within its context – as identified in the MAP function – to inform responsible use and governance.
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
- CT.DM-P1Data elements can be accessed for review.
- CM.AW-P3System/product/service design enables data processing visibility.
- CM.AW-P5Data corrections or deletions can be communicated to individuals or organizations (e.g., data sources) in the data processing ecosystem.
- FINOS AIGF
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Who may demand the log
Data subject
Logging duty
The controller must be able to show on request that it carried out a requested rectification or erasure, and must notify any third party it passed the data to of the operations performed, which cannot be done without a record of the operations. The text names no content or period for the record. English: when the interested person asks, the controller shows, without cost to the requester, that it has made the operations required. The register of processing is in the data protection delegate article, coded on the general row, and the agency’s control over the principles is in a section this row does not cite.
- Kind
- Implicit
- As of
- Provision
- Chapitre VI, rectification article (art. 32): on the data subject’s request the controller must show, at no cost to the requester, that it has carried out the correction, completion, update, blocking or erasure required, and bears the burden of proof if that is contested
- Trigger
- personal_data_processing
What this law does
Anyone with a legitimate reason has the right to object, at any time and free of charge, to the processing of personal data concerning them, and the agency assesses whether a contested reason is legitimate.
A person may obtain, on request, information about the purposes of the processing, the categories of data processed, and the recipients or categories of recipients the data are communicated to, along with the information letting them understand and contest the mechanism of an automated decision that produces legal effects for them.
The person exercises the right of access free of charge, on the spot or remotely, without delay, and receives a copy of their data on request, and where the access concerns health data the controller may communicate it through the physician the person designates. A controller may refuse a manifestly abusive request, repeated or systematic, from the same person, but bears the burden of proving the request was abusive if the refusal is disputed.
On a substantiated request, a person may require a controller to rectify, complete, update, block, or erase personal data concerning them that is inaccurate, incomplete, ambiguous, outdated, or unlawfully collected, used, communicated, or retained, and where the controller had disclosed the data to a third party it must notify that party of the change without delay.
Where a processing activity concerns State security, defense, or public safety, the rights of access and rectification are exercised indirectly, without the data subject's consent, through a request the agency routes to the controller.
Direct marketing by phone, fax, SMS, email, instant message, or social network needs the recipient's prior consent, the recipient must be able to unsubscribe or change their preferences at any time, and where the marketing targets a business or a person acting professionally the controller must still give notice and an unsubscribe option in every communication, as simple and effective as signing up was. The Act states that it takes effect from its date of promulgation.
When LexLint raises it
When your app profile says your app sends automated outreach, makes high-risk automated decisions or processes personal data.
Back to the example · Lint your app
Page updated .