African Union Legal Instrument
P a g e | 24
c)
Communication to him/her of the personal data undergoing processing and
any available information as to their source;
d)
Information as to the purpose of the processing, the categories of personal
data concerned, and the recipients or categories of recipients to whom the
data are disclosed.
Article 18:
Right to object
Any natural person has the right to object, on legitimate grounds, to the processing of
the data relating to him/her.
He/she shall have the right to be informed before personal data relating to him/her are
disclosed for the first time to third parties or used on their behalf for the purposes of
marketing, and to be expressly offered the right to object, free of charge, to such
disclosures or uses.
Article 19:
Right of rectification or erasure
Any natural person may demand that the data controller rectify, complete, update, block
or erase, as the case may be, the personal data concerning him/her where such data
are inaccurate, incomplete, equivocal or out of date, or whose collection, use, disclosure
or storage are prohibited.
Section V: Obligations of the Personal Data Controller
Article 20: Confidentiality obligations
Processing of personal data shall be confidential. Such processing shall be undertaken
solely by persons operating under the authority of a data controller and only on
instructions from the controller.
Article 21:
Security obligations
The data controller must take all appropriate precautions, according to the nature of the
data, and in particular, to prevent such data from being altered or destroyed, or
accessed by unauthorized third parties.
Article 22:
Storage obligations
Personal data shall be kept for no longer than is necessary for the purposes for which
the data were collected or processed.
Article 23:
a)
Sustainability obligations
The data controller shall take all appropriate measures to ensure that
processed personal data can be utilized regardless of the technical device
employed in the process.