withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal; d) when assessing whether consent is freely given, utmost account shall be taken of whether, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary (or excessive) for the performance of that contract and e) where data may be transferred to a third party for any reason whatsoever 2.4 DUE DILIGENCE AND PROHIBITION OF IMPROPER MOTIVES (a) No consent shall be sought, given or accepted in any circumstance that may engender direct or indirect propagation of atrocities, hate, child rights violation, criminal acts and anti-social conducts; (b) A party to any data processing contract, other than an individual data subject, shall take reasonable measures to ensure the other party does not have a record of violating the principles set out in Section 5 and he is accountable to NITDA or a reputable regulatory authority for data protection within or outside Nigeria; accordingly, every Data Processor or Controller shall be liable for the actions or inactions of third parties which handles the personal data of Data Subjects under this Regulation; (c) In this section, “a party” shall include directors, shareholders, servants and privies of the contracting party; and record shall include report public record and reports in credible news media. Accordingly, the distinction between legal and natural persons for the purpose of limiting due diligence is irrelevant. 2.5 PRIVACY POLICY Notwithstanding anything contrary in this Regulation or any instrument for the time being in force, any medium through which personal data is being collected or processed shall display a simple and conspicuous privacy policy that the class of Data Subjects being targeted can understand. The privacy policy shall in addition to any other relevant information contain the following: 9