Commission shall be required to appoint a data protection officer, who is wellversed in the collection and processing of personal data and the risks associated with processing. 6. Consent for personal data processing. (1) The personal data of any kind of a data subject shall not be processed unless the data controller seeks his consent before the commencement of the processing of the data or as prescribed under the provisions of this Act. (2) The consent of the data subject under sub-section (1) must be a free, specific, informed, and unambiguous indication of the data subject's intentions that signifies agreement to the processing of his data for the specified purpose communicated to him. (3) The burden of proof to establish that the data subject has given his consent to the processing of data under this section shall lie with the data controller. (4) The data subject shall have the right to withdraw his consent to the processing of personal data at any time. The consequences of such withdrawal shall be borne by a data subject. The withdrawal of consent shall not affect the lawfulness of processing the personal data based on consent taken before its withdrawal. (5) Where the data subject withdraws his consent to the processing of personal data under-sub-section (4), the data controller shall, within a reasonable time, cease and direct its data processors to cease processing the personal data of such data subject unless such processing can happen without the consent of data subject or authorised under the law. (6) Notwithstanding sub-section (1), a data controller may process the personal data of a data subject if the processing is necessary for the following: (a) for the performance of a contract to which the data subject is a party; (b) for taking steps at the request of the data subject to enter into a contract; (c) for compliance with any legal obligation to which the data controller is the subject, other than an obligation imposed by a contract; (d) for treatment, public health, medical or research purposes or to respond to any medical emergency involving a threat to the life or the health of a data subject or any other individual; 13