(d) Where a data controller or data processor collects personal data of a data subject within the territory of Pakistan including a foreign data subject who is physically present at the time of collection, and processing of personal data within the territory of Pakistan. Provided that in the case of the foreign data subject, the collection is not in conflict with the privacy laws of the country where the data controller is registered. 4. Interpretation. – In this Act, unless the context otherwise requires, the following terms shall be read about Rules made under this Act, and the pronouns “he” and “his” have been used throughout this Act for an individual, irrespective of gender. CHAPTER II PROCESSING OF PERSONAL DATA AND OBLIGATIONS OF DATA CONTROLLERS AND DATA PROCESSORS 5. Grounds for processing personal data. – (1) Personal data shall be collected, processed, and disclosed by a data controller/data processor lawfully and fairly by complying with the provisions of this Act. (2) The personal data shall be collected for specified, explicit and legitimate purposes, which shall not be processed further that is incompatible with the aforementioned purposes and shall be adequate, relevant, and limited to the purposes for which the data is processed. (3) The data controller and/or data processor whether digitally or non-digitally operational within the territory of Pakistan shall register with the Commission in such manner as may be specified by the registration framework to be formulated by the Commission provided that the data controller and/or data processor is already registered with any public body in that case, it shall only be required to intimate the Commission. (4) The data controller and/or data processor identified as “significant” by the 12