a) the name and address of the controller and of his representative, if any;
b) the purposes of the processing;
c) the description of the category or categories of data subjects and of the data or
categories of personal data relating to them;
d) the recipients or categories of recipients to whom the data might be disclosed
and in what circumstances;
e) the entity entrusted with processing the information, if it is not the controller
himself;
f) any combinations of personal data processing;
g) the length of time required for keeping personal data;
h) the form and circumstances in which the data subjects may be informed of or
may correct the personal data relating to them;
i) proposed transfers of data to third countries;
j) a general description enabling a preliminary assessment to be made of the
adequacy of the measures taken under Articles 15 and 16 to ensure security of
processing.
Article 26
(Obligatory information)
1. The legal provisions referred to in subsection b) of paragraph 1 of Article 8 and
paragraph 1 of Article 9 as well as the authorisation of the CNPD and the
personal data processing filing system must, at least, indicate:
a) the controller of the file and his representative, if any;
b) the category of personal data processed;
c) the purpose(s) of the data and the categories of the entities to whom they
might be disclosed;
d) the form of exercising the right of access and rectification;
e) the combinations of personal data processing;
f) the proposed transfers of data to third parties.
2. Any change in the information referred to in 1 shall be subject to the procedures
provided in in Articles 23 and 24.
Article 27
(Publishing processing operations)
1. When personal data processing is not covered by a legal provision and must be
authorised or notified it shall be set down in a CNPD register open to
consultation by any person.
2. The register shall contain the information listed in paragraphs a) to d) and i) of
Article 25.
3. The controller not subject to notification shall make available adequate
information to any person that requests, at least, the information referred to in
paragraph 1 of Article 26.
4. This Article does not apply to processing whose sole purpose is the keeping of a
register which according to laws or regulations is intended to provide