Personal Data Protection and Safeguarding Draft Act June 2019 a) Managers, position-holders, direct data subjects or those related to the processing of personal data b) Infrastructure, structures and hardware and software systems, whether exclusive or shared for processing of personal data c) Documents, information or paper or digital data about and related to processing of personal data. Article 24. Provision of all facilities and human resources necessary for proper implementation of supervision commitments is a responsibility of controller or processor. Article 25. Agreement between controller or processor with the persons who are subject of data or others about supervision is only valid so far as it is not in contradiction with the supervisory commitments of this act. Section Three: Trustability of processing Subsection one: Transparency Article 26. Controller or processor is obliged to make the following information avaliable to the persons who are subject of data: a) the aim of processing, whether economic, social, cultural, health, welfare, legal, judicial or security b) Kind and method of processing, whether gathering, changing, analysis, sharing, saving or erasing of data c) Identity, nature and activity of main and subsidiary controllers or processors d) Processing situations and states whether public or non-public e) Sources of processing including the information banks of public or private bodies or various surveys f) Processing’s details and technical conditions especially in regards to choice of personal data of Iranian citizens which is the section of Section Five of this law g) Licenses issued by relevant authorities h) The level of security and safety of processing and knowledge and the accrued costs ARTICLE 19 – Free Word Centre, 60 Farringdon Rd, London EC1R 3GA – www.article19.org – +44 20 7324 2500 Page 44 of 58