African Union Legal Instrument P a g e | 24 c) Communication to him/her of the personal data undergoing processing and any available information as to their source; d) Information as to the purpose of the processing, the categories of personal data concerned, and the recipients or categories of recipients to whom the data are disclosed. Article 18: Right to object Any natural person has the right to object, on legitimate grounds, to the processing of the data relating to him/her. He/she shall have the right to be informed before personal data relating to him/her are disclosed for the first time to third parties or used on their behalf for the purposes of marketing, and to be expressly offered the right to object, free of charge, to such disclosures or uses. Article 19: Right of rectification or erasure Any natural person may demand that the data controller rectify, complete, update, block or erase, as the case may be, the personal data concerning him/her where such data are inaccurate, incomplete, equivocal or out of date, or whose collection, use, disclosure or storage are prohibited. Section V: Obligations of the Personal Data Controller Article 20: Confidentiality obligations Processing of personal data shall be confidential. Such processing shall be undertaken solely by persons operating under the authority of a data controller and only on instructions from the controller. Article 21: Security obligations The data controller must take all appropriate precautions, according to the nature of the data, and in particular, to prevent such data from being altered or destroyed, or accessed by unauthorized third parties. Article 22: Storage obligations Personal data shall be kept for no longer than is necessary for the purposes for which the data were collected or processed. Article 23: a) Sustainability obligations The data controller shall take all appropriate measures to ensure that processed personal data can be utilized regardless of the technical device employed in the process.