🇽🇰Law No. 06/L-082 on Protection of Personal Data
Law No. 06/L-082 on Protection of Personal Data
The 2019 law applies to automated processing and structured non-automated processing and establishes the Information and Privacy Agency as the supervisory authority.
Core controller and processor duties
Lawfulness and children: Articles 4-8 set the principles, lawful bases, consent conditions, age-16 child-consent rule and special-category restrictions.
Rights: Articles 11-22 cover transparency, access, correction, erasure, restriction, portability, objection and automated decisions.
Accountability: Articles 23-39 cover responsibility, privacy by design and default, representatives, processors, records, security, the 72-hour breach process, DPIAs, prior consultation and DPOs.
Transfers and special activities: Articles 44-50 govern international transfers. Articles 73-74 address direct marketing and Article 75 onward regulates camera surveillance.
A controller using personal data for direct marketing should preserve the permission or other required basis, provide an easy objection route and stop the activity within the law's specific deadline after an objection.
Articles 4-8 - principles, lawful bases, consent and children.
Articles 11-39 - rights and accountability.
Articles 44-50 - international transfers.
Articles 73 onward - direct marketing and surveillance.