Businesses must notify the CDP in respect of its processing activities, except in the following case:

• Processing for the sole purpose of keeping a register, by law, this is intended exclusively to provide public information and is open to consultation for any person with a legitimate interest.
• The non-profit processing for religious, philosophical, or political associations, or trade unions.¹

According to Article 22 of the DPA, the declaration must include:

• The identity and address of the Data Controller or his representative;
• Purpose(s)  of the processing and the description of its general functions;
• Possible interconnections between databases;
• Personal data processed and categories of persons concerned by the processing;
• Time period for which the data will be kept;
• Department or person(s) in charge of data processing;
• Recipient(s) or categories of recipients of the processed data;
• Persons or departments before which the right of access is exercised;
• Measures taken to ensure the security of the processing; and
• Identity and address of the data processor.

The registration process, following the collection and processing of personal data, must comply with the requirements set by law. Thus, in addition to the prior consent of the author of the information, the registration of data is also subject to the respect of the right to information and the principles of transparency, clarity, confidentiality, compliance with the rules of ethics and ethics governing certain professions.²