'Processing' is broadly defined and takes place when any operation or set of operations
is carried out on personal data. The Act requires that personal data be processed "fairly and lawfully".
Personal data will not be considered to be processed fairly unless certain conditions are met. A data
subject must be told the identity of the data controller and why that information is or is to be processed.
Processing may only be carried out where one of the following conditions has
been met:
- the individual has given his or her consent to the processing;
- the processing is necessary for the performance of a contract with the individual;
- the processing is required under a legal obligation;
- the processing
is necessary to protect the vital interests of the individual;
- the processing is
necessary to carry out public functions;
- the processing is necessary in order to
pursue the legitimate interests of the data controller or third parties (unless it could prejudice the
interests of the individual).
