Law No. 2013-450 on the Protection of Personal Data, rights of the data subject

Loi n° 2013-450, arts. 25, 28-38 (rights of the data subject)

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force.

A data subject rights rule binding public and private bodies.

As of 19 September 2026.

What it requires

Give the person concerned, at the latest when you collect their data, your identity, the purpose, the categories of data, the recipients, their right to refuse to appear on the file, their rights of access and rectification, the retention period, and whether the data may be transferred to a third country.
Answer a request for access with confirmation of whether the person's data are processed, the data themselves and their origin, and the purposes, categories and recipients of the processing.
Stop processing a person's data for prospecting purposes as soon as they object, free of charge, and tell them before their data are first disclosed to a third party for prospecting so they can object to that disclosure.
Rectify, complete, update, delete or lock personal data on request where it is inaccurate, incomplete, ambiguous or outdated, including at the request of a deceased person's successors.
Erase a person's personal data and end its distribution on request, including data made available while they were a minor, where it is no longer necessary, where consent is withdrawn, where the processing lacks a legal ground, or for another legitimate reason, and tell every third party the data were disclosed to that removal is sought.
Give a person their personal data in a structured, commonly used electronic format on request, and forward it to another system where the processing rests on consent or a contract.
Do not base a court, administrative or private decision assessing a person's behavior or personality solely on automated processing of their personal data.

What it reaches

Obligation class

Data subject rights, Disclosure, Access restriction

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Article 28 requires the person responsible for the processing to give the person concerned, at the latest when the data are collected, their identity, the purpose, the categories of data, the recipients, the possibility of refusing to appear on the file, the existence of the rights of access and rectification, the retention period, and the possibility of a transfer to a third country.

Article 29 gives a person the right to obtain confirmation of whether their data are being processed, the data themselves and their origin, and the purposes, categories and recipients of the processing, and lets the Protection Body exercise that access on the person's behalf where direct access is impossible.

Article 30 gives a person the right to object to processing on legitimate grounds relating to their situation, to object at no cost to processing for prospecting purposes, and to be told before their data are first disclosed to a third party for prospecting and given the right to object to that disclosure free of charge.

Article 31 gives a person the right to have inaccurate, incomplete, ambiguous or outdated personal data rectified, completed, updated, deleted or locked, and article 32 extends that right to a deceased person's successors.

Article 33 gives a person the right to erasure of their personal data and to the end of its distribution, including data made available while they were a minor, where it is no longer necessary, where consent is withdrawn or the retention period has lapsed with no other legal ground, where the processing lacks a legal ground, or for any other legitimate reason, and articles 34 to 36 require the person responsible to tell any third party the data were disclosed to that the person concerned seeks removal of every link, copy or reproduction, to carry out the erasure without delay unless a listed ground for retention applies, and to establish mechanisms implementing that right and periodically reviewing the need to keep data.

Article 38 gives a person the right to receive their data in a structured, commonly used electronic format and, where the processing rests on consent or a contract, to have it forwarded to another system. Article 25 bars any court, administrative or private decision assessing a person's behavior or personality from resting solely on automated processing of their personal data.

When LexLint raises it

crawls_web
trains_models
deploys_chatbot
automated_outreach
high_risk_decisions
serves_minors

Read the law

Official English-language rendering of Law No. 2013-450 published by ARTCI
(Autorité de Régulation des Télécommunications/TIC de Côte d'Ivoire) the French original circulated on ARTCI's own site is a scanned-image PDF with no extractable text layer, so this rendering, whose translation quality is uneven in places, is the readable copy of the Act, an Internet Archive capture

archived copy

Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived February 18, 2026. Publisher's page: https://www.artci.ci/images/stories/pdf-english/lois_english/loi_2013_450_english.pdf

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app