Section 25: Processing of sensitive personal data

25. Processing of sensitive personal data (1) No sensitive personal data shall be processed unless the data subject— (a) gives his express consent to the processing of the personal data; or (b) makes the data public. (2) Subsection (1) shall not apply where the processing— (a) is necessary— (i) for exercising or performing any right or obligation which is conferred or imposed by law on the data controller in connection with his employment; (ii) in order to protect the vital interests of the data subject or another person in a case where consent cannot be given by or on behalf of the data subject, or the data controller cannot reasonably be expected to obtain the consent of the data subject; (iii) in order to protect the vital interests of another person, in a case where consent by or on behalf of the data subject is unreasonably withheld; (iv) for the performance of a contract to which the data subject is a party; (v) in order to take steps required by the data subject prior to entering into a contract; (vi) for compliance with a legal obligation to which the data controller is subject; (b) is carried out by any charitable entity or any association which exists for political, philosophical, religious or trade union purposes, in the course of its legitimate activities and the processing— (i) is carried out with the appropriate safeguards specified under sections 22, 23, 26 and 27; (ii) is related only to individuals who are members of the charitable entity or association; and (iii) does not involve disclosure of the personal data to a third party without the consent of the data subject; (c) is in respect of the information contained in the personal data made public as a result of steps deliberately taken by the data subject; (ca) is required by any investigatory authority under the Financial Intelligence and Anti-Money Laundering Act; (d) is required by law. [S. 25 came into operation on 16 February 2009; amended by s. 10 of Act 27 of 2013 w.e.f. 21 December 2013.] D3 – 15 [Issue 6] Data Protection Act