Data collection and processing are subject to the following principles and requirements:

• The collection, recording, processing, storage, and transmission of personal data must be lawful, fair, and not fraudulent;
• Data must be collected for specified, explicit, and legitimate purposes;
• Data must be relevant and not excessive in relation to the purposes for which they are collected and further processed;
• Data must be kept for a period not exceeding the period necessary for the purposes for which they were collected / processed;
• The data collected must be accurate and, if necessary, updated whenever necessary;
• Data controller must inform the data subject of any personal data processing operation that involves personal data; and
• Personal data must be treated confidentially and protected. 

Rights of the data holders / subjects

• To be informed: Pursuant to Article 35 and seq. of the Act, the data controller must inform the data subject of:
  • the identity of the data controller and its representative (if any);
  • the purposes of the processing;
  • the category of data concerned;
  • the recipients or categories of recipients of the data;
  • the right to object to the collection of such data;
  • the right to access the collected data and have it edited;
  • the duration of the processing; and
  • details on any intended transfer of the data. 
• To access: Pursuant to Article 38 of the Act, data subjects have a right of access and they can obtain the following from the data controller:
  • information allowing for data subjects to be aware of and the possibly to contest the processing;
  • confirmation of whether his / her personal data forms part of the processing;
  • copy of his / her personal data as well as any available information on the origin of the data; and
  • information relating to the purposes of the processing, categories of data processed, recipients, or categories of recipients, to whom the data are disclosed, and information relating to the transfer of personal data outside the country.
• To rectification: In light of the provisions of Article 48 of the Act, any data subjects may require that the data controller rectifies their personal data if it is inaccurate, incomplete, unclear, or expired, or if the collection, usage, disclosure, or retention of the data is prohibited;
• To erasure: In light of the provisions of Article 48 of the Act, any data subjects may require that the data controller deletes their personal data if it is inaccurate, incomplete, unclear, or expired, or if the collection, usage, disclosure, or retention of the data is prohibited;
• Right to object / opt-out: Pursuant to Article 45 of the Act, any data subject has the right to object, with legitimate reasons, to the processing of his / her personal data. The data subject also has the right to be informed before his / her personal data is communicated or used by a third party and also to object the communication or the use of the personal data.