Data Protection and Responsible Data Management Policy

Issued by: AFEX-TD General Management — Data protection contact: Operation Manager, aabilla@afex-td.com — Version: 1.0 — Effective date: 3 April 2023

This English text is a translation of the original French policy, which prevails in case of difference.

1. Preamble and purpose

Africa Expertise – Transformation & Development (AFEX-TD) is a firm incorporated under Chadian law, specialising in project evaluation, research and studies. In carrying out its assignments, AFEX-TD collects, analyses, processes and transfers data relating to natural persons: clients, donors, partners, survey respondents, project beneficiaries and members of its team. This activity engages the firm's legal and ethical responsibility.

This policy sets out the principles and rules for transparent, secure, ethical and responsible data management at AFEX-TD throughout the data life cycle, from collection to deletion. It is part of a framework that will evolve with technological, regulatory and contractual changes, and will be reviewed periodically for this purpose.

1.1 Key commitments of the policy

To be fully effective, this policy:

• has been formally approved by AFEX-TD General Management (see chapter 18);

• is communicated and made accessible to all staff and other people concerned (see chapter 15);

• explains how AFEX-TD's data and IT systems must be protected (see chapters 6 and 11, annexes C and E);

• sets out the roles and responsibilities of the people in charge of its implementation (see chapter 14);

• provides rules on access, passwords, backups and data exchanges (see chapter 6.3, annexes C and E);

• explains how to report and manage a data incident or breach (see chapter 13);

• provides for the retention and secure deletion of information (see chapter 6.5);

• complies with applicable national laws and international standards (see chapter 3);

• sets out the obligations of staff and consultants deployed on projects commissioned by clients or donors (see chapter 9).

2. Scope

This policy applies:

• to AFEX-TD as a whole, and to any entity affiliated with it;

• to the partners, managers, employees, interns, enumerators and independent consultants working on behalf of AFEX-TD, whatever the project on which they are deployed (hereinafter "Team Members");

• to clients, donors commissioning projects, research partners, sub-contractors and any other organisation acting in the name or on behalf of AFEX-TD (hereinafter "Clients" or "Partners");

• to any person surveyed, respondent, beneficiary or informant met in the course of AFEX-TD's evaluation, research or study assignments (hereinafter "Data Subjects");

• to all data processed by AFEX-TD, in digital or paper form, whatever its medium or place of storage.

3. Legal framework

3.1 National law

AFEX-TD carries out its activities in accordance with Law No. 007/PR/2015 of 10 February 2015 on the protection of personal data and its implementing decree, Decree No. 075/PR/2019 of 21 January 2019 implementing Law No. 007/PR/2015. The national data protection system is supervised by the National Agency for IT Security and Electronic Certification (ANSICE).

3.2 International reference

As an additional reference for good practice, particularly for assignments funded by international donors, AFEX-TD draws on Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation — GDPR).

In the event of divergence, Chadian law applies as of right on the national territory. The GDPR is applied as enhanced good practice where the contractual requirements of a donor or partner require it, or where data of persons falling within the scope of the GDPR are processed.

4. Definitions

Data: any information made up of letters, numbers, symbols, images or any combination of these, in digital or physical form.

Personal data: any information that can identify, directly or indirectly, a natural person ("Data Subject") or a distinct demographic group. Common examples: name, address, telephone number, date of birth, national identification number.

Sensitive data: a sub-category of personal data that could be used to target or discriminate against a person or group, in particular ethnic origin, political or religious opinions, sexual orientation, health, and biometric or genetic data (see annex A).

Personally identifiable information (PII): information relating to an identified or identifiable natural person, directly or indirectly, in particular by reference to an identifier or to one or more factors specific to their physical, physiological, economic, cultural or social identity.

Demographically identifiable information (DII): information that can identify a distinct community or group, whether geographic, ethnic, religious, economic or political.

Data subject: any natural person who can be identified, directly or indirectly, by reference to personal data concerning them.

Data controller: the natural or legal person who determines the purposes and means of the collection, storage, processing or dissemination of personal data. For AFEX-TD's assignments, this is in principle AFEX-TD itself, unless the assignment contract provides otherwise.

Processor: the natural or legal person who processes personal data on behalf of and on the instructions of the data controller.

Informed consent: any freely given, specific and informed indication by which a Data Subject agrees to the collection and processing of their data, obtained in writing, orally or through a clear affirmative action, at the time of collection or as soon as possible afterwards.

Data minimisation: the principle of collecting only data that are adequate, relevant and limited to what is strictly necessary for the purpose pursued.

Legitimate interest: a legal basis for processing that requires a valid and necessary purpose; it may be overridden if the Data Subject exercises their right to the confidentiality of their data.

De-identification: any processing method intended to prevent the identification of a Data Subject. It includes anonymisation and pseudonymisation (see annex D).

Anonymisation: an irreversible process by which personal data are made anonymous, so that the data subject can no longer be identified.

Pseudonymisation: processing that makes personal data no longer attributable to a data subject without the use of additional information (a "key code"), kept separately and protected.

Data sharing agreement (DSA): an agreement between AFEX-TD and a third party setting out the conditions for using shared personal data: data concerned, transfer method, authorised uses, security measures, etc.

Privacy impact assessment (PIA): a process for identifying and managing privacy risks related to a new project, tool or partnership involving personal or sensitive data (see annex B).

Data breach: any security incident leading, accidentally or unlawfully, to the destruction, loss, alteration, disclosure of, or unauthorised access to, personal data.

5. Data processing principles

When AFEX-TD collects personal data, it undertakes to make reasonable efforts to ensure that they are:

• processed lawfully, fairly and transparently;

• collected for specified, explicit and legitimate purposes;

• adequate, relevant and limited to what is necessary (minimisation);

• accurate and, where necessary, kept up to date;

• kept only for as long as necessary, then deleted in accordance with the retention rules applicable to the contract or assignment, where applicable after 90 days;

• processed and stored in a way that ensures confidentiality, security and appropriate accountability.

6. Data life cycle

AFEX-TD's activity covers the entire data life cycle, including collection, analysis, processing and transfer. Each stage calls for specific measures, detailed in the annexes to this policy.

6.1 Collection

• obtain the informed consent of respondents and inform them of the purpose of the collection;

• apply the minimisation principle from the design of collection tools (questionnaires, interview guides, etc.);

• pay particular attention to the collection of sensitive data (see annex A).

6.2 Analysis and processing

• restrict access to raw data to the team members who need it;

• whenever possible, analyse de-identified data (see annex D);

• secure the workstations and media used for processing.

6.3 Storage and security

• encrypt files containing personal or sensitive data (see annex E);

• use storage platforms approved by AFEX-TD, with access control, for all assignment data;

• protect each account and device (computer, email, collection tool) with a strong personal password, never shared or reused from one account to another;

• back up assignment data regularly on a medium or space separate from the collection device, itself protected and with restricted access;

• periodically review access rights to folders and databases, and remove them without delay when a staff member changes role or leaves.

6.4 Sharing and transfer

• govern any external data sharing by a data sharing agreement (DSA) specifying purpose, content, security measures and duration;

• share only what is strictly necessary, anonymising whenever possible (see annex C);

• pay particular attention to transfers to clients, donors or partners located outside Chad.

6.5 Retention and deletion

• define, for each assignment, a retention period proportionate to its purpose, specified in the contract or study protocol;

• securely delete the data at the end of that period, unless a longer retention period is required by law or contract.

7. Rights of data subjects

Any Data Subject may ask to consult, correct or delete personal data concerning them, or concerning any person for whom they are legally responsible. Requests are sent to AFEX-TD's data protection contact at: aabilla@afex-td.com. A request may be limited on legitimate legal, ethical, contractual or operational grounds that prevent AFEX-TD from responding to it in full.

8. Disclosure of data to third parties

AFEX-TD exercises reasonable diligence to avoid any unintended sharing of personal data with third parties not covered by the sharing. Any disclosure to a third party (client, authority, partner) for legal, contractual or accountability reasons takes into account:

• why the third party is requesting the information and whether it needs to be disclosed;

• whether the Data Subject has given informed consent;

• the Data Subject's reasonable expectations regarding the disclosure of their data;

• the risk of direct or indirect harm to the Data Subject.

As far as possible, information shared with third parties is anonymised. Any exception is approved by General Management.

9. Projects commissioned by clients and donors

Almost all the data collected by AFEX-TD are collected in the course of assignments commissioned by a client, which may be an international organisation, a donor or a third-party government entity. This chapter sets out the specific obligations of staff, consultants and enumerators deployed on these projects, in addition to the general rules of this policy.

9.1 Commitment of staff deployed on a project

Every Team Member (staff, consultant or enumerator) deployed on a project reads and signs, before deployment, any confidentiality policy, code of conduct or other data protection document required by the client commissioning the project. This commitment is in addition to adherence to this policy, which remains the minimum standard for all AFEX-TD activities.

9.2 Compliance with client requirements

• for each project, the staff, consultants and enumerators deployed comply fully with the data protection policy and standards of the client concerned, as defined in the contract, the study protocol or the data sharing agreement (DSA) applicable to the project;

• where the client's requirements are stricter than those of this policy, they prevail for the duration and scope of the project; this policy applies on a supplementary basis to anything the client's contract does not cover;

• the assignment lead identifies, from the start of the project, the client's specific data protection requirements and includes them in the project's privacy impact assessment (chapter 10, annex B).

9.3 Transfer of data between AFEX-TD and the client

Data collected on behalf of a client are transferred to that client, or to any third party it designates, only under the conditions and within the limits set by the client's data protection policy and by the data sharing agreement governing the project. No data are transferred beyond this scope, to another client, another project or a third country, without the express authorisation of the client and, where applicable, the consent of the Data Subject.

9.4 Retention and destruction of data at the end of a project

The arrangements for retaining and destroying data collected for a client are set by the contract or by that client's data protection policy. Unless otherwise stipulated, AFEX-TD's general retention rules (chapter 6.5) apply on a supplementary basis. At the end of the project, AFEX-TD retains, returns or destroys the data in accordance with the client's instructions, and keeps a documented record of the operation.

10. Privacy impact assessment (PIA)

A privacy impact assessment is required before the launch of any new project, evaluation assignment or study involving the collection of personal or sensitive data, before the adoption of any new collection tool or technology, and before engaging any new partner or sub-contractor processing data on behalf of AFEX-TD. The procedure to follow is detailed in annex B.

11. Information and systems security

The security of AFEX-TD's data and IT systems (computers, email accounts, collection tools, storage spaces) relies on a combination of technical and organisational measures:

• technical measures: encryption of sensitive data (annex E), strong personal passwords, control of access to accounts and folders, regular backups;

• organisational measures: good file-sharing practices (annex C), team awareness and training (chapter 15), incident reporting procedure (chapter 13).

All equipment used to collect, analyse or store assignment data (laptop, tablet, phone) must be protected by a password or passcode and physically secured when not in use, particularly in the field.

12. Accountability and feedback mechanism

For its assignments involving communities or beneficiaries, AFEX-TD sets up a mechanism for receiving and handling feedback, concerns or complaints, while respecting the confidentiality of informants. The data management rules specific to this mechanism are detailed in annex F.

13. Data breaches

Any Team Member who becomes aware of or suspects a data breach (loss, theft, unauthorised access, accidental disclosure) informs the data protection contact without delay at: aabilla@afex-td.com. AFEX-TD assesses the severity of the incident, takes the necessary corrective measures and, where required by Chadian law, notifies ANSICE and the persons concerned.

14. Governance and responsibilities

• AFEX-TD General Management approves this policy, oversees its application and reviews it periodically.

• The Operation Manager is AFEX-TD's data protection focal point: she oversees compliance with this policy, responds to requests from data subjects and can be contacted at aabilla@afex-td.com.

• Assignment or project leads are responsible, in the field, for compliance with this policy and for carrying out the required privacy impact assessments.

• Every Team Member must comply with this policy and report any data-related incident or risk.

15. Communication, accessibility and training

This policy and its annexes are communicated to all Team Members and kept permanently available to them. They are given to every new staff member, intern or consultant on joining, and brought to the attention of the Partners involved in an assignment. A public version is published on the AFEX-TD website.

Every Team Member receives, on joining, information on the content of this policy and its annexes. Periodic reminders are organised, particularly before the launch of assignments involving the collection of sensitive data.

16. Sanctions and compliance

Any breach of this policy may lead to disciplinary measures against Team Members, or to the termination of agreements concluded with Partners, without prejudice to the penalties provided for by Law No. 007/PR/2015 and its implementing decree.

17. Annexes

This policy is supplemented by the following practical guides, which set out its operational application:

• Annex A — Guide on sensitive data

• Annex B — Privacy impact assessment (PIA) guide

• Annex C — File and data sharing guide

• Annex D — Data de-identification guide (anonymisation and pseudonymisation)

• Annex E — File encryption and security guide

• Annex F — Accountability and feedback management guide

18. Approval and review

This policy has been formally approved by AFEX-TD General Management, which is responsible for it and oversees its application. It is reviewed at least every 5 years, or earlier in the event of significant changes in the Chadian legal framework, international standards, information systems or the firm's activities. Any amendment is approved by General Management and communicated as set out in chapter 15.