b) it is mandatory for the controller to process personal data on grounds of a legal provision; c) it is processing data made public; ç) it processes personal data obtained on grounds of consent of the data subject. 4. The controller, while processing personal data pursuant to letter letter “dh” point 1 of Article 6 and letter “ç” point 2 of Article 7, regarding the exercise or protection of legitimate rights, is obliged to inform data subject on processing of personal data related to him. 5. The duty to inform, regulated under this Article, may be performed by the processor on behalf of the controller. Article 19 Obligation to rectify and erase 1. Upon its own initiative or upon the request of the data subject, the controller shall carry out the blocking, rectification or erasure of personal data, when it ascertains that personal data are inaccurate, untrue, and incomplete or have been processed in contradiction with the provisions of this law. 2. Within 30 days from receipt of the request by the data subject, the controller informs the data subject whether the blocking, rectification or erasure has been carried out. 3. The controller informs the recipient of personal data on the rectification or erasure of the personal data transmitted before the rectification or erasure. 24 Article 20 Obligations of the Processor 1. The controllers may recruit processors to process personal data. The processor shall guarantee lawful and safe use of data. All personal data processors shall have the following obligations: a) to process data only according to the instructions of the controller; not to transmit data unless so instructed by the controller; b) to take all required safety measures, in compliance with this law and to employ operators who are bound by confidentiality; c) to create in agreement with the controller the necessary technical and organisational requirements for the fulfilment of the controller’s obligations to ensure the protection of data subjects’ rights; ç) to hand over to the controller after the completion of the processing service all the results of processing and documentation containing data or to keep or destroy them on controller’s request; d) to make available to the controller all information necessary to control the compliance with the obligations stemming from the abovementioned provisions. 2. Obligations of point 1 are stipulated in the written contract entered into between the Controller and Processor. 25