These are the prior formalities that data controllers must complete before implementing certain types of data processing. These formalities may take the form of declarations or requests for authorisation, depending on the nature of the processing. 

In principle, any processing of personal data is subject to prior declaration to the protection authority (article 5 of the 2013-450 Data Protection Act). The declaration must include detailed information about the processing, such as the identity of the person responsible, the purposes of the processing, the types of data processed, and the security measures put in place (article 9 of the aforementioned law).

However, certain types of processing are exempt from prior declaration under article 10 of the aforementioned law. These include:

• Processing carried out by a natural person in the exclusive context of his or her personal or domestic activities, provided that the data is not intended for systematic communication to third parties
• Processing for the sole purpose of keeping a register for exclusively private use
• Processing carried out by an association or non-profit-making body of a religious, philosophical, political or trade union nature, subject to certain conditions
• Processing of data concerning a natural person whose publication is required by law
• Processing operations for which the data controller has appointed a data protection correspondent, except in the event of data being transferred to a third country

As for Prior Authorisation in accordance with Article 7 of the aforementioned 2013 Act, it is required for Certain processing operations considered riskier for privacy. This concerns:

• Processing of genetic data and research in the field of health
• Processing of data relating to offences, convictions or security measures
• Processing of a national identification number or any other similar identifier, in particular telephone numbers
• Processing of biometric data
• Processing in the public interest, in particular for historical, statistical or scientific purposes
• The transfer of personal data to a third country
• The interconnection of files
• Processing carried out on behalf of the State: The processing of personal data carried out on behalf of the State, a public establishment or a local authority, or a legal person under private law managing a public service shall be decided by legislative or regulatory act adopted after a reasoned opinion from the national data protection authority (article 13)
• Transfers of personal data to a third country

Registration process

• The declaration or request for authorisation may be sent to the protection authority electronically, by post or by any other means against delivery of an acknowledgement of receipt (in accordance with Article 10 of the aforementioned Act).
• ARTCI must give its decision within one month of receipt of the declaration or request for authorization. This period may be extended by a further month. Failure to respond within the time limit is equivalent to a rejection ‘Article 5 of Decree No. 2015 -79 of 04 February 2015, laying down the procedures for filing declarations, submitting applications, granting and withdrawing authorizations for the processing of personal data.
• For the most common categories of processing, the ARTCI may establish standards to simplify or exempt from the declaration obligation.
• Once the declaration has been made, the data protection authority issues a receipt, which may be issued electronically. The applicant may then begin processing but remains responsible for compliance with the law.