Law No. 09-08 on the Protection of Individuals with Regard to the Processing of Personal Data D-35 to 37: Decree Articles 35 to 37 and 39: how rights requests are received and handled

What does D-35 to 37 require?

Requests to exercise the rights of Articles 7 to 9 may be made in writing (signed, with a copy of an identity document and the precise object), electronically or on site, where the person may be assisted by counsel or represented by a specially mandated person proving the mandate; a request addressed to the head office of the organisation must be passed to the controller immediately. If a request is imprecise or incomplete, the controller must ask for the missing elements before the deadlines expire, which suspends them. Where several controllers manage a file jointly, access may be exercised against each unless one is responsible for all, and a person not authorised to answer must forward the request promptly.