(a) when the data controller first requests the data subject to provide his personal data; (b) when the data controller first collects the personal data of the data subject; or (c) in any other case, before the data controller— (i) uses the personal data of the data subject for a purpose other than the purpose for which the personal data was collected; or (ii) discloses personal data to a third party. (3) A notice under sub-section (1) shall be served in English or any other language as specified in Article 251 of the Constitution of the Islamic Republic of Pakistan, 1973; and the individual shall be provided with a clear and readily accessible means to choose his choice of language. 8. Non-disclosure of personal data. – Subject to section 24, personal data without the consent of the data subject shall not be disclosed—For any purpose other than— (a) the one for which the personal data was to be disclosed at the time of collection of the personal data; or (b) a purpose directly related to the purpose referred to in clause (a) of sub-section (1); or (c) to any party other than a third party as specified in clause (f) of sub-section (1) of section 7. 9. Security requirements. – (1) Given the national interest, the Commission shall prescribe the best international standards to protect personal data from any loss, misuse, modification, unauthorised or accidental access or disclosure, alteration, or destruction. (2) A data controller or processor shall when collecting or processing personal data must take practical measures to protect the personal data as per the terms mentioned herein below by considering the nature of the personal data and the harm that may result from such loss, misuse, modification, unauthorised or accidental access or disclosure, alteration, or destruction: (a) to the place or location where the personal data is stored; (b) to any security measures incorporated into any equipment in which the personal data is stored; 15