Personal Data Protection and Safeguarding Draft Act June 2019 i) The rights of persons who are subject of data to processing of their personal data and how to use them j) Special supervisor of processing and other relevant supervisors and those following up on complaints by the the persons who are subject of data. Note: Controller or processor is obliged to make the information available a month after receiving personal data, based on the provisions of this article. Article 27. Informing the persons who are subject of data should be in accordance with their individual and social conditions and the facilities in their use and their level and, in addition to general and exclusive informing, should happen via documents such as “conditions and concerns of processing” so that their knowledge is assured. Subsection Two: Non-threatability Article 28: Each of the functions and stages of processing should enjoy their own special safety and security provisions. These should cover all the three following levels: a) Physical security and safety including infrastructure, structures and relevant hardware systems b) Safety and security of information including all software and hardware processors c) Human safety and security including all main and subsidiary controllers and processors Article 29. Required or suggested safety hardware and software processes and tools should meet the following conditions: a) Kind and degree of damage caused by potential and active threats from the point of view of persons who are subject of data; b) Being practical; c) technical and executive capacity. Article 30. The persons who are subject of data can only require the controller or processor to observe safety and security provisions above those of the regulations of relevant authorities if implication of these doesn’t disrupt their responsibilities and if they can bear the cost. ARTICLE 19 – Free Word Centre, 60 Farringdon Rd, London EC1R 3GA – www.article19.org – +44 20 7324 2500 Page 45 of 58