Loi n°007/PR/2015, droits de la personne concernée (information, accès, opposition, rectification)

Article 35 requires a controller collecting personal data directly from the data subject to provide, at collection, its own identity, the processing purposes, the categories of data, the recipients, the retention period, the existence of access and rectification rights, and any prospect of transfer to a third country; article 36 extends this duty to data not collected directly from the data subject, timed to registration or first communication to a third party.

Article 38 lets any natural person demand, free of charge, confirmation of whether their data is processed, communication of that data and its origin, information on the processing's purposes, legal basis, categories, and recipients, and information on any transfer to a third country, plus a copy of the data at no more than reproduction cost; the controller may refuse a manifestly abusive request, bearing the burden of proving abuse.

Article 45 gives any natural person the right to object, on legitimate grounds, to processing of their personal data, and specifically to object, free of charge, before their data is first communicated to a third party or used for prospecting on a third party's behalf, except where the processing meets a legal obligation.

Article 46 lets any natural person demand, free of charge, that the controller rectify, complete, update, block, or erase personal data concerning them that is inaccurate, incomplete, equivocal, outdated, or unlawfully collected, used, communicated, or retained, within one month of a written request, on pain of a complaint to ANSICE.

Article 48 has a minor's rights exercised by the parent holding parental authority or the minor's guardian, with the minor associated to the exercise of those rights according to age and maturity.