Section 4

Grounds for processing personal data

Official Text Verified Last Verified: Recently

4. (1) A person may process the personal data of a Data Principal only in accordance with the provisions of this Act and for a lawful purpose,ΓÇö

(a) for which the Data Principal has given her consent; or

(b) for certain legitimate uses.

(2) For the purposes of this section, the expression "lawful purpose" means any purpose which is not expressly forbidden by law.

Editorial Explanation

What this means: A company can only process your data if they have a legal reason to do so. This legal reason must be either:
1. You gave them your explicit consent.
2. It falls under "certain legitimate uses" (like a medical emergency or government service, as defined later in Section 7).