Loi n° 2019-014, droits de la personne concernée

Loi n° 2019-014 du 29 octobre 2019, arts. 26-27, 35-50 (rights of data subjects)

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force.

A data subject rights rule binding public and private bodies.

As of 19 September 2026.

What it requires

Tell a data subject, at the latest when you collect their personal data directly from them, your identity, the purposes of the processing, the categories of data and recipients, whether answering is mandatory, their right to be excluded from the file, their rights of access and rectification, the retention period, and any transfer abroad you envisage.
Answer an access request by confirming whether you process the person's data, providing it in an accessible form with its origin, purposes, categories and recipients, and any transfer abroad, and deliver a copy at no more than reproduction cost.
Let a data subject object, on legitimate grounds, to the processing of their personal data, and tell them before their data is first disclosed to or used by a third party for prospecting, offering a free right to object to it, unless the processing meets a legal obligation.
Correct, complete, update, lock or delete personal data on a data subject's written request within one month and at no cost, when it is inaccurate, incomplete, ambiguous, outdated or unlawfully held, and notify any third party the data was disclosed to.
Where you have made a data subject's personal data public, take reasonable measures, including technical ones, to tell third parties processing that data to erase links to it or any copy, when the data subject asks.
Do not send unsolicited direct marketing to a person using their personal data without their prior consent to receive it.
Do not base a court decision on a person's conduct, or a decision producing legal effects concerning a person, solely on an automated evaluation of their personal characteristics or profile, except a contractual decision on which they could state their views or one granting their own request.
Let the heirs of a deceased data subject require you to record the death and make the necessary updates, and justify doing so at no charge.

What it reaches

Obligation class

Data subject rights, Disclosure, Access restriction

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Article 35 requires a controller collecting data directly from the data subject to disclose, at the latest when collecting it, its identity, the purposes of the processing, the categories of data, the recipients, whether an answer is mandatory, the possibility of objecting to inclusion in the file, the rights of access and rectification, the retention period, and any transfer abroad envisaged.

Article 39 gives a data subject the right to demand confirmation of processing, communication of their data in an accessible form together with its origin, and information on the purposes, categories, recipients and any transfer abroad, and article 40 entitles them to a copy at no more than reproduction cost.

Article 45 gives a data subject the right to object, on legitimate grounds, to processing of their data, and the right to be told before their data is first disclosed to or used by a third party for prospecting and to object to that disclosure or use free of charge, subject to the exception for processing required by a legal obligation.

Article 46 lets a data subject demand correction, completion, updating, locking or deletion of data that is inaccurate, incomplete, ambiguous, outdated or unlawfully held, within one month and at no cost, and requires the controller to notify any third party the data was disclosed to.

Article 47 requires a controller who has made a data subject's data public to take reasonable measures, including technical ones, to tell third parties processing that data to erase links to it or any copy, on the data subject's request. Article 26 bars unsolicited direct marketing using a person's data without their prior consent to receive it.

Article 27 bars founding a court decision on a person's conduct, or any decision producing legal effects concerning them, solely on an automated evaluation of their personal characteristics or profile, other than a contractual decision on which they could state their views or a decision granting their own request.

Article 50 lets the heirs of a deceased data subject require the controller to record the death and make the necessary updates, and requires the controller to justify doing so free of charge.

When LexLint raises it

crawls_web
trains_models
deploys_chatbot
automated_outreach
high_risk_decisions

Read the law

Journal Officiel de la République Togolaise
numéro spécial du 29 octobre 2019, cited through an Internet Archive capture of the Ministry of the Digital Economy's PDF (numerique.gouv.tg)

archived copy

Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2020. Publisher's page: https://numerique.gouv.tg/wp-content/uploads/2020/01/Loi-n-2019-014-du-29-octobre-2019-relative-a-la-protection-des-donnees-a-caractere-pers…

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app