Section 4: Grounds for processing personal data

Section 4 establishes the fundamental rules for when any person or organization can process personal data under the Act. It states that the personal data of a Data Principal, which is the individual to whom the data relates, can only be processed if the processing complies with the provisions of the Act. Furthermore, the processing must always be for a lawful purpose. The section limits the processing of personal data to two specific grounds. First, data can be processed if the Data Principal has explicitly given their consent for that processing. Second, data can be processed for certain legitimate uses. These legitimate uses are specific scenarios recognized by the Act where obtaining consent is not necessary. Finally, the section provides a clear definition of what constitutes a lawful purpose. It states that a lawful purpose is any purpose that is not expressly forbidden by law. This means that as long as the reason for collecting and using the personal data is not illegal or prohibited by other legislation, it meets this requirement.

Key points

• Personal data can only be processed in accordance with the Act and for a lawful purpose [(1)].
• Processing is permitted if the Data Principal has given their consent [(1)(a)].
• Processing is also permitted for certain legitimate uses [(1)(b)].
• A lawful purpose is defined as any purpose that is not expressly forbidden by law [(2)].

Common misreadings

• One might think a lawful purpose requires a specific law authorizing the processing, but the Act clarifies it simply means the purpose must not be expressly forbidden by law.