Section 28: Lawful processing
as enacted (not consolidated). juris shows this Act from a copy that is not the official consolidation, so it may not carry every amendment; the amendments juris holds are listed. It does not confirm that this is the law in force today.
28. Lawful processing
(1) No person shall process personal data unless –
(a) the data subject consents to the processing for one or
more specified purposes;
(b) the processing is necessary –
(i) for the performance of a contract to which the
data subject is a party or in order to take steps
at the request of the data subject before entering
into a contract;
(ii) for compliance with any legal obligation to
which the controller is subject;
(iii) in order to protect the vital interests of the data
subject or another person;
(iv) for the performance of a task carried out in
the public interest or in the exercise of official
authority vested in the controller;
(v) the performance of any task carried out by a
public authority;
492 Acts 2017 Acts 2017 493
(vi) the exercise, by any person in the public interest,
of any other functions of a public nature;
(vii) for the legitimate interests pursued by the
controller or by a third party to whom the
data are disclosed, except if the processing
is unwarranted in any particular case having
regard to the harm and prejudice to the rights
and freedoms or legitimate interests of the data
subject; or
(viii) for the purpose of historical, statistical or
scientific research.
(2) Any person who contravenes subsection (1) shall commit an
offence and shall, on conviction, be liable to a fine not exceeding 100, 000
rupees and to imprisonment for a term not exceeding 5 years.