Rights and Obligations

🚨 𝐋𝐚𝐛𝐨𝐮𝐫-𝐜𝐨𝐝𝐞 𝐜𝐨𝐦𝐩𝐥𝐢𝐚𝐧𝐜𝐞 𝐢𝐬 𝐧𝐨𝐭 𝐚 𝐨𝐧𝐞-𝐰𝐚𝐲 𝐬𝐭𝐫𝐞𝐞𝐭. We repeatedly ask: ➤ Were wages paid correctly? ➤ Was social security deposited? ➤ Is the workplace safe? ➤ Was due process followed? All valid questions. But another must also be confronted: ❝ 𝐖𝐡𝐚𝐭 𝐚𝐛𝐨𝐮𝐭 𝐭𝐡𝐞 𝐫𝐞𝐬𝐩𝐨𝐧𝐬𝐢𝐛𝐢𝐥𝐢𝐭𝐲 𝐚𝐧𝐝 𝐚𝐜𝐜𝐨𝐮𝐧𝐭𝐚𝐛𝐢𝐥𝐢𝐭𝐲 𝐨𝐟 𝐰𝐨𝐫𝐤𝐞𝐫𝐬 𝐚𝐧𝐝 𝐞𝐦𝐩𝐥𝐨𝐲𝐞𝐞𝐬? ❞ Labour laws rightly place major obligations on employers because they control wages, records, safety systems and disciplinary processes. But 𝐩𝐫𝐢𝐦𝐚𝐫𝐲 𝐞𝐦𝐩𝐥𝐨𝐲𝐞𝐫 𝐫𝐞𝐬𝐩𝐨𝐧𝐬𝐢𝐛𝐢𝐥𝐢𝐭𝐲 𝐝𝐨𝐞𝐬 𝐧𝐨𝐭 𝐦𝐞𝐚𝐧 𝐜𝐨𝐦𝐩𝐥𝐞𝐭𝐞 𝐞𝐦𝐩𝐥𝐨𝐲𝐞𝐞 𝐢𝐦𝐦𝐮𝐧𝐢𝐭𝐲. ❶ 𝐒𝐀𝐅𝐄𝐓𝐘 𝐈𝐒 𝐒𝐇𝐀𝐑𝐄𝐃 Employees must use PPE, follow safety standards, report hazards, cooperate with safety systems and avoid wilfully endangering anyone. Yet the employer must first provide a safe workplace, training, supervision and equipment. ➝ Safety cannot be outsourced. ➝ Cooperation cannot be optional. ❷ 𝐃𝐈𝐒𝐂𝐈𝐏𝐋𝐈𝐍𝐄 𝐑𝐄𝐌𝐀𝐈𝐍𝐒 𝐄𝐍𝐅𝐎𝐑𝐂𝐄𝐀𝐁𝐋𝐄 Standing orders and service rules may regulate attendance, shifts, leave, late coming, misconduct, suspension and dismissal. Habitual absenteeism, falsification of records, negligence, insubordination or property damage may invite action—but only under 𝐜𝐥𝐞𝐚𝐫𝐥𝐲 𝐜𝐨𝐦𝐦𝐮𝐧𝐢𝐜𝐚𝐭𝐞𝐝 𝐫𝐮𝐥𝐞𝐬. ❸ 𝐔𝐍𝐈𝐎𝐍 𝐑𝐈𝐆𝐇𝐓𝐒 𝐀𝐋𝐒𝐎 𝐂𝐀𝐑𝐑𝐘 𝐃𝐔𝐓𝐈𝐄𝐒 Lawful collective action deserves protection. But violence, intimidation, illegal strikes, wilful go-slow, gherao, property damage or preventing others from working cannot be justified as union freedom. ✦ Rights protect representation. ✦ They do not authorise coercion. ❹ 𝐖𝐀𝐆𝐄 𝐏𝐑𝐎𝐓𝐄𝐂𝐓𝐈𝐎𝐍 𝐈𝐒 𝐍𝐎𝐓 𝐌𝐈𝐒𝐂𝐎𝐍𝐃𝐔𝐂𝐓 𝐏𝐑𝐎𝐓𝐄𝐂𝐓𝐈𝐎𝐍 Regulated deductions may be made for absence and proven loss caused by negligence or default—subject to evidence, explanation, procedure and recovery limits. Fraud, theft, sabotage, violence or misappropriation may also affect statutory entitlements. ❺ 𝐀𝐂𝐂𝐎𝐔𝐍𝐓𝐀𝐁𝐈𝐋𝐈𝐓𝐘 𝐌𝐔𝐒𝐓 𝐒𝐓𝐈𝐋𝐋 𝐁𝐄 𝐅𝐀𝐈𝐑 Before punishment, the employer must ensure: ➼ clear expectations ➼ evidence-based allegations ➼ show-cause or charge-sheet ➼ fair domestic inquiry ➼ proportionate punishment ➼ consistent treatment 🅐 Poor performance may require counselling, training or a PIP. 🅑 Misconduct involves a deliberate or culpable breach of a known rule. Every error is not misconduct. Every disagreement is not insubordination. The right equation is: 𝐄𝐦𝐩𝐥𝐨𝐲𝐞𝐫 𝐜𝐨𝐦𝐩𝐥𝐢𝐚𝐧𝐜𝐞 ➕ 𝐄𝐦𝐩𝐥𝐨𝐲𝐞𝐞 𝐫𝐞𝐬𝐩𝐨𝐧𝐬𝐢𝐛𝐢𝐥𝐢𝐭𝐲 ➕ 𝐔𝐧𝐢𝐨𝐧 𝐚𝐜𝐜𝐨𝐮𝐧𝐭𝐚𝐛𝐢𝐥𝐢𝐭𝐲 ➕ 𝐅𝐚𝐢𝐫 𝐞𝐧𝐟𝐨𝐫𝐜𝐞𝐦𝐞𝐧𝐭 🟰 𝐀 𝐫𝐞𝐬𝐩𝐞𝐜𝐭𝐟𝐮𝐥, 𝐩𝐫𝐨𝐝𝐮𝐜𝐭𝐢𝐯𝐞 𝐚𝐧𝐝 𝐥𝐚𝐰𝐟𝐮𝐥 𝐰𝐨𝐫𝐤𝐩𝐥𝐚𝐜𝐞. ❝ Rights carry responsibilities. Authority carries accountability. Discipline requires due process. Compliance belongs to everyone. ❞

Know Your your labour Laws; Understanding Gratuity Entitlements & Compliance Under Zambia’s Employment Code Act, 2019🇿🇲 The Employment Code Act No. 3 of 2019 introduced key reforms to Zambia’s labor laws, with mandatory gratuity payments for employees on fixed-term contracts being one of the most impactful provisions. Yet, many businesses and employees remain unaware of their obligations and rights under this law. Are you in compliance? 🔹 What does the law say? Section 73 of the Act states that employees engaged on fixed-term contracts exceeding 12 months are entitled to a gratuity payment of at least 25% of their total basic pay earned during the contract period. This entitlement applies whether or not the contract is renewed and must be paid within one month of contract expiration. 🔹 Compliance Matters: What Employers Must Do Failure to comply with gratuity provisions can result in legal penalties, financial liabilities, and reputational risks. Here’s how employers can ensure compliance: 🔹Review Contracts: Ensure all fixed-term contracts clearly state the gratuity entitlement. 🔹Budget Accordingly: Gratuity obligations should be accounted for in financial planning to avoid last-minute challenges. 🔹Timely Payouts: Payments must be processed within the legally required timeframe to avoid disputes or legal action. 🔹 HR & Payroll Integration: HR teams must align employment contracts and payroll systems with the Act’s requirements. For Employees; 🔹Check Your Contract: Ensure your employment contract reflects gratuity provisions if you’re on a fixed-term agreement. 🔹Stay Informed: Awareness of your rights helps in ensuring fair treatment in the workplace. 🔹Seek Redress If Needed: If gratuity is not paid as required, employees have the right to seek legal recourse. The Bigger Picture: Building a Culture of Compliance Beyond legal requirements, adhering to labor laws promotes trust, employee satisfaction, and a fair work environment. Compliance is about creating ethical, transparent, and sustainable workplaces. Have you encountered challenges or best practices in handling gratuity payments? Share your insights in the comments!

𝐃𝐏𝐃𝐏 𝐀𝐜𝐭 𝐃𝐞𝐜𝐨𝐝𝐞𝐝 | 𝐂𝐥𝐮𝐬𝐭𝐞𝐫 4: 𝐎𝐛𝐥𝐢𝐠𝐚𝐭𝐢𝐨𝐧𝐬 𝐨𝐟 𝐃𝐚𝐭𝐚 𝐅𝐢𝐝𝐮𝐜𝐢𝐚𝐫𝐢𝐞𝐬 𝐚𝐧𝐝 𝐏𝐫𝐨𝐜𝐞𝐬𝐬𝐨𝐫𝐬 Once processing is lawful, what must a Data Fiduciary actually do — and what happens when things go wrong? • What does non-delegable responsibility mean for your outsourcing architecture? • When does data quality become a legal requirement, not a best practice? • What security safeguards does Rule 6 actually mandate? • How do retention and erasure work when multiple laws pull in different directions? • And what must your breach response, processor contracts, and grievance mechanisms look like to survive Board scrutiny? Cluster 4 of my DPDP Act Decoded series answers these across ten posts, covering: • Why outsourcing does not outsource responsibility under Section 8(1) • When data quality is a legal obligation, not a perfection standard • What "appropriate technical and organisational measures" mean for a mid-sized company • How "reasonable" security safeguards are now defined by Rule 6 • Why a personal data breach is not limited to external attacks • How retention, purpose limitation, and mandated erasure actually work • What a "valid contract" with a Data Processor must cover • Why publishing DPO/contact details is a compliance function, not a checkbox • How to build effective grievance redressal without overbuilding • Why lifecycle mapping — not document mapping — is where compliance becomes real I've compiled these posts, along with custom infographics, into a single practitioner note for reference and internal circulation. If Cluster 3 tells you how to establish a lawful basis, this cluster tells you what obligations attach to it. Read it before designing security controls, processor contracts, or breach response playbooks. If you find this useful for your team, I'd appreciate a share — this series is meant to reach the people building DPDP programmes, not just reading about them. (Links to the individual posts and earlier clusters are in the comments.) #DPDP #DPDPAct #DPDPA #DataProtection #PrivacyLaw #Compliance #DataPrivacy #CyberSecurity #IndiaLaw

The first legal document I ever worked on was a Non-Disclosure Agreement (NDA). It took me almost 2 hours just to work through it once — not because it was long, but because I was trying to make sense of the legal language and structure. The main challenge? Understanding how the clauses fit together, what they actually meant, and why each one mattered. But once I cracked the structure, I started reading NDAs not as walls of text, but as modular documents built on purpose. Now, I can go through one in 20–30 minutes — efficiently and effectively. Here’s a quick breakdown of the typical structure and key clauses in most NDAs: 🔹 Definitions Sets the scope of terms like “Confidential Information,” “Disclosing Party,” and “Receiving Party.” Precision here determines the entire reach of the agreement. 🔹 Confidentiality Obligations Specifies how the receiving party must treat the disclosed information — non-disclosure, limited use, and care standards. 🔹 Exclusions Identifies categories of information not covered — e.g., information already in the public domain or independently developed. 🔹 Permitted Disclosures Outlines when and to whom confidential information can be disclosed (e.g., affiliates, advisors, or under legal obligation). 🔹 Term and Survival Sets the duration of the NDA and how long confidentiality obligations last — often surviving the termination of the agreement. 🔹 Return or Destruction Obligates the receiving party to return or destroy confidential information upon request or at the end of the relationship. 🔹 Remedies and Governing Law Provides for equitable remedies (like injunctive relief) in case of breach, and establishes the governing law and jurisdiction.

𝐓𝐡𝐞 𝐋𝐚𝐛𝐨𝐮𝐫 𝐋𝐚𝐰𝐬 𝐇𝐑 𝐂𝐚𝐧’𝐭 𝐀𝐟𝐟𝐨𝐫𝐝 𝐭𝐨 𝐈𝐠𝐧𝐨𝐫𝐞 Too often, HR hides behind “𝐜𝐨𝐦𝐩𝐚𝐧𝐲 𝐩𝐨𝐥𝐢𝐜𝐲.” But let’s be honest, a policy that contradicts labour law is 𝐢𝐥𝐥𝐞𝐠𝐚𝐥, no matter how beautifully it’s worded. I understand HR is under pressure from management, but pressure is no excuse to break the law. Our role is to protect both the business and the people. Here are a few hard truths HR must face: 🚫 𝐒𝐚𝐥𝐚𝐫𝐲 𝐃𝐞𝐝𝐮𝐜𝐭𝐢𝐨𝐧𝐬: Arbitrary deductions for lateness, uniforms, or “fines” are not discipline they’re unlawful. 🚫 𝐌𝐢𝐧𝐢𝐦𝐮𝐦 𝐖𝐚𝐠𝐞: Paying below minimum wage (even with “consent”) is exploitation in disguise. 🚫 𝐏𝐫𝐨𝐛𝐚𝐭𝐢𝐨𝐧 𝐀𝐛𝐮𝐬𝐞: Extending probation endlessly without benefits isn’t smart HR, it borders on exploitation. 🚫 𝐂𝐚𝐬𝐮𝐚𝐥𝐢𝐬𝐚𝐭𝐢𝐨𝐧: Renewing short-term contracts just to avoid benefits isn’t innovation, it undermines trust and the law. 🚫 𝐔𝐧𝐥𝐚𝐰𝐟𝐮𝐥 𝐓𝐞𝐫𝐦𝐢𝐧𝐚𝐭𝐢𝐨𝐧: “Management decision” is not a lawful reason for dismissal. Due process matters. 🚫 𝐋𝐞𝐚𝐯𝐞 𝐃𝐞𝐧𝐢𝐚𝐥𝐬: Annual leave, sick leave, maternity leave, these are rights, not favours. 🚫 𝐒𝐚𝐥𝐚𝐫𝐲 𝐃𝐞𝐥𝐚𝐲𝐬: Owing staff for months while still demanding performance? That’s not strategy, that’s theft of labour. 🛎️ 𝐄𝐱𝐩𝐥𝐨𝐢𝐭𝐚𝐭𝐢𝐨𝐧 𝐢𝐧 𝐟𝐢𝐧𝐞 𝐩𝐫𝐢𝐧𝐭 𝐢𝐬 𝐬𝐭𝐢𝐥𝐥 𝐞𝐱𝐩𝐥𝐨𝐢𝐭𝐚𝐭𝐢𝐨𝐧. The real test of HR is not in recruitment drives or engagement events, it’s in how we act when business goals clash with labour rights. The picture attached shows the legal references for further details, because 𝐜𝐨𝐦𝐩𝐥𝐢𝐚𝐧𝐜𝐞 𝐢𝐬𝐧’𝐭 𝐚𝐛𝐨𝐮𝐭 𝐨𝐩𝐢𝐧𝐢𝐨𝐧, 𝐢𝐭’𝐬 𝐚𝐛𝐨𝐮𝐭 𝐭𝐡𝐞 𝐥𝐚𝐰. 𝐃𝐞𝐚𝐫 𝐇𝐑, 𝐭𝐡𝐞 𝐪𝐮𝐞𝐬𝐭𝐢𝐨𝐧 𝐰𝐞 𝐦𝐮𝐬𝐭 𝐚𝐬𝐤 𝐢𝐬 𝐭𝐡𝐢𝐬: Will we keep hiding behind policies, or will we finally uphold the law we’re meant to protect? #LabourLaw #HumanResources #BalanceintheWorkplace #WorkplaceEthics #FutureOfWork #Nigeria

Think the EU AI Act only hits Big Tech? Think again. If your company uses AI in hiring, credit, or monitoring, even through a vendor, you're in scope. The AI Act is risk-based regulation with different rules for "providers" (who build AI) and "deployers" (who use it). Most commercial organizations fall into one of these buckets. The reality is you're probably a "deployer" with obligations. If your AI system or its output is used in the EU, you're in scope. Even if you're a U.S. company with no EU operations. 𝗙𝗼𝘂𝗿 𝗖𝗮𝘁𝗲𝗴𝗼𝗿𝗶𝗲𝘀 𝗬𝗼𝘂 𝗡𝗲𝗲𝗱 𝘁𝗼 𝗞𝗻𝗼𝘄: 🚫 Prohibited AI (banned since Feb 2025) Social scoring, emotion recognition in workplaces/schools, real-time biometric ID in public spaces ⚠️ High-Risk AI (compliance deadline: Aug 2, 2026) Recruitment tools, employee monitoring, task allocation, credit scoring, biometric ID 💬 Transparency AI (disclosure required) Chatbots, deepfakes, AI-generated content must be labeled 🤖 GPAI Models (Big Tech problem) New models compliant since Aug 2025. Existing models until Aug 2027 𝗣𝗿𝗼𝘃𝗶𝗱𝗲𝗿 𝘃𝘀. 𝗗𝗲𝗽𝗹𝗼𝘆𝗲𝗿 Using an AI recruitment or monitoring/evaluation system? Algorithmic scheduling? AI-powered credit decisions? Biometric access control? Emotion recognition? You're a "deployer." Your vendor is the "provider." "My vendor handles compliance" is NOT a defense. You have separate, independent obligations. 𝗣𝗿𝗼𝘃𝗶𝗱𝗲𝗿 𝗼𝗯𝗹𝗶𝗴𝗮𝘁𝗶𝗼𝗻𝘀 (𝘃𝗲𝗻𝗱𝗼𝗿𝘀):  • Conformity assessment before market release  • Technical documentation and CE marking  • Risk management and data governance systems  • Quality management system  • Registration in EU database  • Post-market monitoring and incident reporting 𝗗𝗲𝗽𝗹𝗼𝘆𝗲𝗿 𝗼𝗯𝗹𝗶𝗴𝗮𝘁𝗶𝗼𝗻𝘀:  • Human oversight, monitoring, data governance, potentially fundamental rights impact assessments  • Follow provider instructions and maintain logs  • Monitor AI performance in practice  • Report serious incidents  • Ensure input data quality 𝗪𝗵𝗮𝘁 𝗬𝗼𝘂 𝗠𝘂𝘀𝘁 𝗗𝗼 𝗕𝘆 𝗔𝘂𝗴𝘂𝘀𝘁 𝟮, 𝟮𝟬𝟮𝟲: ✓ Human Oversight – Meaningful ability to intervene (not rubber-stamping) ✓ Monitoring – Track performance, log incidents ✓ Data Governance – Quality-check input data ✓ Impact Assessments – Assess fundamental rights before deployment ✓ Documentation – Maintain logs and follow instructions 𝗧𝗵𝗲 𝗕𝗼𝘁𝘁𝗼𝗺 𝗟𝗶𝗻𝗲 If you're using AI-powered HR tools, credit decision-making, or biometric systems, you have compliance obligations by August 2026.   The goal isn't perfection. It's demonstrable good faith effort, documented risk assessment, and avoiding prohibited practices. ---------- This is part 2 of my recap from Phil Lee's session on the EU Data Act and AI Act at the Openli AI Summit. Part one covered the EU Data Act (link in comments). This post covers the AI Act.

This month's Connecticut AG privacy report and court ruling allowing CCPA regs to become enforceable show areas where privacy programs may need attention.     The Office of the Connecticut Attorney General reported that it has open investigations for: (1) privacy policy deficiencies; (2) confusing, burdensome, and ineffective data subject rights processes; (3) consent practices for sensitive data; (4) teens' data and #TargetedAdvertising; and (5) #DataBroker compliance with deletion rights. It also revealed it added additional staff for privacy enforcement.    A court unblocked the California Privacy Protection Agency #CCPA regulations which have detailed requirements in areas including: (1) collection and use limits; (2) the right to limit use of sensitive data; (3) rights fulfillment and request processes; (4) reporting rights metrics; and (5) required contract terms with service providers and third parties.   To confirm your privacy program is set to address these developments, check in on these six areas:   1️⃣ Data subject right request processes 🔸Describe and make them available to CT residents 🔸Scrub request processes for ease of use and clear descriptions 🔸Check that all links are functional 🔸Review opt-out rights for "sales" and targeted advertising for new symmetry and #DarkPatterns regs 🔸Make sure any cookie banner and consent tool is tailored to US rights, including consistently describing opt-out of sale/targeted advertising rights in notices and related banners/tools   2️⃣ Data subject right fulfillment processes 🔸Validate processes for sending deletion requests to service providers and third parties 🔸Make adjustments for the CA required steps for the right to correct 🔸Test that opt-out preference signals are being received and associated with customer records for "sales" and targeted advertising per the CA regs 🔸Re-examine prior risk-based decisions to de-scope any of these required steps   3️⃣ Sensitive data rights 🔸Confirm compliant opt-in consent processes before #SensitiveData is collected or processed 🔸Affirm whether you have to offer the right to limit uses of sensitive data under the new CA regs 🔸If required, confirm the "Limit the Use of My Sensitive Personal Information" link is on your website   4️⃣ Privacy notices 🔸Clearly disclose the rights available to CT residents 🔸Describe appeal rights for data subject rights 🔸Disclose the new CA-required metric types about data subject rights 🔸If your notices still describe #privacy rights and protections on a state/jurisdiction basis, consider whether that still makes sense   5️⃣ Privacy assessment processes 🔸Consider specific collection and use restrictions in the #CCPA regs 🔸Look for all sensitive personal data types 🔸Confirm sensitive data opt-ins are obtained & address use limitation rights   6️⃣ Contracting processes 🔸Validate contract processes address the specific CA-required provisions 🔸Have an appropriate plan for updating legacy contracts

Your contract ended. Your risk didn’t. Know how? There’s a thing called "Post-Termination" obligations. For bigger projects, risks remain even after the project ends. And this is what many new founders overlook. Normally, contracts end. But does your confidentiality obligation end with them? What about: • Indemnity? • IP rights? Most people assume these protections stick around. They don’t. Not unless you make it clear with a survival clause. The most common situation I can share with you is this: Imagine you’re a software developer. You just wrapped up a big project for a fintech client. The contract ends. Two months later, you discover: • They’re leaking sensitive code you shared. • You demand action. Their lawyer points to a loophole: • “No survival clause.” • “Your confidentiality obligation ended when the contract did.” Now your hands are tied. This isn’t hypothetical. It happens. Why? Because people underestimate what happens after a contract ends. So there's two risks you have to look out for: 1. Loss of Protection Without a survival clause, your confidentiality agreement vanishes with the contract. 2. IP Disputes Failing to extend IP rights can leave you fighting for control over your own work. But how can you get it right? Two main ways I suggest are. a) Identify Key Clauses Confidentiality, IP rights, liability, and indemnity are usually critical. b) Specify a Duration Confidentiality for 5 years? Indemnity forever? Be precise. So remember that contracts end. Risks don’t. A survival clause keeps your most important protections alive. Even when the contract is long gone. —— 📌 If you need Contracts that consider the risks that carry over after a Contract ends, then DM me "CONTRACT".

🧐 Roles and Responsibilities Under the EU AI Act? 📍 The EU AI Act introduces one of the most complex accountability frameworks ever applied to technology and there are a number of practical achallanges. One of those practical challanges is: Who is responsible for what? 👆 AI systems rarely come from a single source. Providers build foundation models, others fine-tune or integrate them, and deployers use them in real contexts. When obligations such as transparency, human oversight, or incident reporting apply, roles often blur. 🚨 The paper “Subject Roles in the EU AI Act: Mapping and Regulatory Implications” (Fabiano, 2025) tackles this uncertainty. Under Article 3, the Act distinguishes six key roles: provider, deployer, authorised representative, importer, distributor, and product manufacturer, each carrying distinct duties. A key insight is that these roles are not static: 👉 Article 25 allows role transformation. A deployer who substantially modifies an AI system or controls its data or outputs effectively becomes a provider. 👉 Deployers, under Article 26, now bear active responsibilities: maintaining human oversight, logging activity for at least six months, reporting incidents, and where applicable, performing Fundamental Rights Impact Assessments (Article 27). ⚠️ Compliance follows control. Liability, documentation, and monitoring obligations align with who exercises factual influence over the AI system not. 🎯 Bottom Line: For organisations across the AI value chain, understanding and documenting which role it has is the the foundation of legal compliance and accountability under the AI Act. 🔗 to the paper in the comments #artificialintelligence #EUAIAct #liability #compliance #governance