19
2019
Data Protection
No.
(ii) for the enforcement of a law which imposes a
pecuniary penalty; or
(iii) for the protection of the interests of the data
subject or another person.
(3) A data controller or data processor shall collect,
store or use personal data for a purpose which is lawful,
specific and explicitly defined.
29. A data controller or data processor shall, before
collecting personal data, in so far as practicable, inform the
data subject of —
Duty to notify.
(a) the rights of data subject specified under section
26;
(b) the fact that personal data is being collected;
(c) the purpose for which the personal data is being
collected;
(d) the third parties whose personal data has been or
will be transferred to, including details of
safeguards adopted;
(e) the contacts of the data controller or data processor
and on whether any other entity may receive the
collected personal data;
(f) a description of the technical and organizational
security measures taken to ensure the integrity and
confidentiality of the data;
(g) the data being collected pursuant to any law and
whether such collection is voluntary or mandatory;
and
(h) the consequences if any, where the data subject
fails to provide all or any part of the requested
data.
30. (1) A data controller or data processor shall not
process personal data, unless—
(a) the data subject consents to the processing for one
or more specified purposes; or
(b) the processing is necessary—
(i)
for the performance of a contract to which
the data subject is a party or in order to take
Lawful processing
of personal data.
!