both, or other device, and any material subsequently derived from
information so-produced, recorded or stored;
(iii) label, marking or other writing that identifies or describes anything
of which it forms part, or to which it is attached by any means;
(iv) book, map, plan, graph or drawing; or
(v) photograph, film, negative, tape, or other device in which one or
more visual images are embodied so as to be capable, with or
without the aid of some other equipment, of being reproduced;
(b) in the possession or under the control of a data controller;
(c) whether or not it was created by the data controller; and
(d) regardless of when it came into existence;
“re-identify” in relation to personal information of a data subject, means to resurrect
any information that has been de-identified, that –
(a) identifies the data subject;
(b) can be used or manipulated by a reasonably foreseeable method to identify
the data subject; or
(c) can be linked by a reasonably foreseeable method to other information that
identifies the data subject.
“sensitive personal information” (a) refers to genetic data, data related to children,
data related to offences, criminal sentences or security measure, biometric data as
well as, if they are processed for what they reveal, personal information revealing
racial or ethnic origin, political opinions, religious or philosophical beliefs,
affiliation, trade-union membership, gender and data concerning health or sex life
(b) refers also to any personal information otherwise considered by Lesotho law as
presenting a major risk to the rights and interests of the data subject, in particular