b) the further processing is solely for the purpose of scientific research, historical research or for statistical purposes in the public interest; or c) the further processing is required in compliance with a legal obligation. 4.2 Data Protection Impact Assessment As stated in parapgraph 3.2 (viii) Data Controllers and Data Administrators are required to conduct DPIAs, where applicable. NITDA may however request the submission of a DPIA from any Data Controller or Administrative where such processing activities is deemed to be of high impact on data subjects. A DPIA may be required for the following types of Processing: a) evaluation or scoring (profiling); b) automated decision-making with legal or similar significant effect; c) systematic monitoring; d) when sensitive or highly Personal Data is involved; e) when Personal Data Processing relates to vulnerable or differently-abled data subjects; and f) when considering the deployment of innovative processes or application of new technological or organizational solutions. 5. UNDERSTANDING CONSENT 5.1 Consent of the Data Subject means any freely given, specific, informed and unambiguous indication of the Data Subject's wishes by which he or she, through a statement or a clear affirmative action, signifies agreement to the processing of Personal Data relating to him or her. Consent may be made through a written statement, sign or an affirmative action signifying agreement to the processing of personal data. 11 | P a g e