MadagascarDecree No. 2023-1541, declaration, register and data protection officer
Décret n° 2023-1541, arts. 64-74 (déclaration, registre et délégué à la protection des données)
In force.
A comprehensive regime rule binding public and private bodies.
- Obligation class
- Governance, Licensing
- Audit expectation
- none
What it requires
- Declare computerized processing to the CMIL before starting it, and start only once the declaration receipt is obtained.
- Keep the register of computerized processing, in physical or electronic form, with the contact details of the controller, any subcontractor and the data protection officer, the purposes, the CMIL's opinions and authorizations, the categories of data subjects, data and recipients, any transfers abroad, the retention period and the security measures.
- For processing that presents the risks article 46 of Law No. 2014-038 specifies, ask the CMIL beforehand for authorization, justify that the interest of the processing prevails over the fundamental rights and freedoms of the data subject, and begin only after the CMIL notifies its authorization.
- As a public-law legal entity, address the request for the CMIL's binding opinion on public-sector processing through the entity's legal representative.
- Choose the data protection officer on professional qualities in computing and data protection, and notify the CMIL of the controller's identity and professional contact details, the officer's identity and professional contact details, and the date of designation.
- Before revoking the data protection officer, inform the CMIL by any written means eight days ahead, giving the serious ground that article 54 of Law No. 2014-038 requires.
These lines are LexLint's reading of the law's text.
What it makes you log
Logging duty
Article 66 requires a register of computerized processing, in physical or electronic form, listing the controller, purposes, categories, recipients, transfers abroad, retention period and security measures. The listed fields match none of the registered content values. The article states no retention period for the register itself and no access right for the CMIL, which Article 6 of the Decree and Article 50 of the Act address on the CMIL row.
- Kind
- Explicit
- As of
- Provision
- Article 66
- Trigger
- personal_data_processing
What this law does
Article 65 states that prior declaration of computerized processing consists in informing the CMIL of the intention to process, and that the processing starts after a declaration receipt is obtained. Article 66 allows the register of computerized processing to take a physical or electronic form.
Article 66 requires the register to hold the names and contact details of the controller, any subcontractor and the data protection officer, the purposes, the CMIL's opinions and authorizations, the categories of data subjects, data and recipients, any transfers abroad, the retention period and the security measures. Article 67 requires the legal representative of a public-law legal entity to address the request for the CMIL's binding opinion on public-sector processing.
Article 68 requires a controller whose processing presents the risks that article 46 of Law No. 2014-038 specifies to ask the CMIL beforehand for authorization, and to justify that the interest of the processing prevails over the fundamental rights and freedoms of the data subject. Under article 68 the processing may begin only after the CMIL notifies its authorization.
Article 69 requires the receipt of a simplified declaration of conformity to carry the name of the declarant and the norm declared. Article 72 requires the designation of the data protection officer to rest on professional qualities in computing and data protection.
Article 73 requires the notification of the officer's designation to the CMIL to state the identity and professional contact details of the controller, the identity and professional contact details of the officer, and the date of designation. Article 74 requires a controller that plans to revoke its data protection officer to inform the CMIL by any written means eight days before the revocation, giving the serious ground that article 54 of Law No. 2014-038 requires.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .