DATA PRIVACY ACT

PRIVACY NOTICE:
• What personal data will be collected • Who will process
• Why personal data is processed Identity and contact details
Purposes of collection Recipients or classes of recipients
Basis of processing to whom personal data re or
maybe disclosed
• How personal data will be collected, Transfer outside the country
used, assessed and stored including
security measures in place. • Rights of data subjects
automated processing that will be
basis of making decisions that
would affect the data subject
The info for which information will
be stored
 RIGHTS OF DATA SUBJECTS
• 1. Right to information
• 2. Right to object
• 3. Right to access
• 4. Right to correct
• 5. Right to erase
• 6. Right to damages
• 7. Right to data portability
• 8. Right to file a complaint
 LEGITIMATE PURPOSE
• processing of information shall be compatible with a declared and specific
purpose which must not be contrary to law, morals or public policy
• Should have consent
 CONSENT NOT NECESSARY

• Contractual, legal obligation, law regulation

• To protect life/health- national emergency, public order, public safety
• To protect health, vitality, important interests
• Protection of rights in court
• Processing is necessary for purposes of medical treatment- as long as there is
insurance of adequate level of protection of personal information
 PROPORTIONALITY
• Processing of information shall be adequate, relevant, suitable, necessary
and not excessive in relation to a declared or specified purpose
• Processing could not reasonably be fulfilled by other means
 ORGANIZATIONAL SECURITY
MEASURES
• Data protection officer
• Privacy impact assessment
• Privacy manual
 CRITERIA FOR LAWFUL PROCESSING
OF PERSONAL INFORMATION
• Data subject has given consent
• Processing of personal information is necessary to protect vitally important
interests of the data subject, including life and health
• Processing is necessary to respond to national emergency, for public order
and safety
 PROCESSING OF SENSITIVE PERSONAL
INFORMATION- PROHIBITED, EXCEPT:

• Data subject has given consent

• Processing is necessary to protect the life and health of data subject or
another person
• Processing is necessary for purposes of medical treatment, carried out by a
medical practitioner or a medical treatment institution and with and
adequate level of protection