Personal Data Protection and Safeguarding Draft Act June 2019 Subsection three: Accountability Article 31. Controllers should be fully responsible to persons who are subject of data; whether their responsibilities emanates from an agreed contract or memorandum of understanding or documents like privacy guidelines. Article 32. The assumption is that the rights of persons who are subjects of data won’t be trampled upon and the controller is obliged to observe all of these rights unless the opposite can be proven. Section Four: Referability of processing Article 33. Controller or processor is required to safeguard all or any data and information mentioned below until at least six months after erasure of personal data: a) Log files and traffic data obtained by processing of personal data; b) Identity information of persons who are subjects of data; c) Kinds of processing done to the relevant data and their aim or aims. Note: the commission can increase the time for keeping and securing of information or data relevant to this article to two years, on a case by case basis. Article 34: If the correctness and integrity of personal data of someone is violated, it is incumbent upon the controller or processor to keep all original and inaccurate data for six months from the date of last processing that led to the inaccuracy. Article 35. Data and information relevant to this section can be used against controller and processor. Article 36. If the relevant authorities issued general safeguarding regulations and instructions, implementig them in processing of personal data is necessary and the cost is to be borne by the controller or the processor. ARTICLE 19 – Free Word Centre, 60 Farringdon Rd, London EC1R 3GA – www.article19.org – +44 20 7324 2500 Page 46 of 58