The Data Protection Bill, 2012
fall within any of paragraphs (a) to (d);
"data controller" means a person who, either alone or with
others, controls the contents and use of personal information;
"data equipment" means equipment for processing data;
"data processor" means a person who processes personal
information on behalf of a data controller but does not include an
employee of a data controller who processes such information in the
course of his or her employment;
"data subject" means an individual who is the subject of
personal information;
"disclosure", in relation to personal information, includes the
disclosure of information extracted from such data and the transfer
of such data but does not include a disclosure made directly or
indirectly by a data controller or a data processor to an employee or
agent of his for the purpose of enabling the employee or agent to
carry out his duties and, where the identification of a data subject
depends partly on the data and partly on other information in the
possession of the data controller, the data shall not be regarded as
disclosed unless the other information is also disclosed;
“electronic record” means a record generated in digital form by
an information system, which can be transmitted within an
information system or from one information system to another and
stored in an information system or other medium;
“person” has the meaning assigned to it in Article 260 of the
Constitution;
“personal data” means information about a person, including,
but not limited to—
(a) information relating to the race, gender, sex, pregnancy,
marital status. national, ethnic or social origin, colour, age,
physical or mental health, well-being, disability, religion,
conscience, belief, culture, language and birth of the
individual;
(b) information relating to the education or the medical,
criminal or employment history of the individual or
information relating to financial transactions in which the
4