African Union Legal Instrument k) P a g e | 17 Envisaged transfer of personal data to a third country that is not a member of the African Union, subject to reciprocity. 7. The national protection authority shall take a decision within a set timeframe starting from the date of receipt of the request for opinion or authorization. Such timeframe may however be extended or not on the basis of an informed decision of the national protection authority. 8. The notification, the declaration or request for authorization may be addressed to the national protection authority by electronic means or by post. 9. The national protection authority may be approached by any person acting on his/her own, or through a lawyer or any other duly mandated natural or legal person. Section II: Institutional framework for the protection of personal data Article 11: Status, composition and organization of National Personal Data Protection Authorities 1. a. Each State Party shall establish an authority in charge of protecting personal data. b. The national protection authority shall be an independent administrative authority with the task of ensuring that the processing of personal data is conducted in accordance with the provisions of this Convention. 2. The national protection authority shall inform the concerned persons and the processing officials of their rights and obligations. 3. Without prejudice to Article 11.6, each State Party shall determine the composition of the national personal data protection authority. 4. Sworn officials may be invited to participate in audit missions in accordance with extant provisions in States Parties. 5. a. Members of the national protection authority shall be subject to the obligation of professional secrecy in accordance with the extant texts of each State Party.