- To guarantee, a posteriori, the checking of the identities of people that have had an access to the information network, to the data that have been inserted in the network, to the time of this insertion as well as the person who did it; - To prevent the data from being read, copied, modified, deleted or struck off at the time of its communication or its media transport; - To save the data by the constitution of a stock of secured copies. Article 20: When the data controller entrusts to third -parties some or all the processing within the framework of a sub- contracting contract, he shall choose the subcontractor very carefully. The sub-contractor shall observe the provisions of this Act and may act only under the data controller's authorized limitations. Furthermore, the subcontractor shall offer all the required and appropriate technical means to carry out his assignments. In case of violation of the provisions of this Act, the data controller and the sub-contractor shall engage their civil liabilities. Article 21: The data controller and the sub-contractor shall rectify, complete, modify, update or delete personal data from data files if they know of any inaccuracy or insufficiency in this data. In this case, the data controller and the sub-contractor must inform the data subject and the data beneficiary of every modification made to the personal data. Notification shall be done within two months from the date of modification, by registered letter with acknowledgement on receipt or by any other means that leave a written trace. Article 22: Without prejudice of the laws and rules in force, the individual or the legal representative of a legal entity who applied for the processing of personal data, as well as their employees, must fulfill the following conditions: - To be Tunisian; - To be resident in Tunisia; - To be without criminal record. These conditions shall also apply to the sub-contractor and his employees. Article 23: Even after the end of the processing or loss of their qualities, the data controller, the sub-contractor and their employees must protect the confidentiality of personal data and the processed information, except when diffusion of information has been accepted in writing by the data subject or in all cases regulated by the law in force. Article 24: The data controller and the sub-contractor, who intend putting an end to their activities, shall inform the "Instance" three months before the date of suspension of their activities. 5