Act Data Protection And Privacy Act 2019 (a) the retention of the data is required or authorised by law; (b) the retention of the data is necessary for a lawful purpose related to a function or activity for which the data is collected or processed; (c) the retention of the data is required by a contract between the parties to the contract, or (d) the data subject consents to the retention of the data. (2) Subsection (1) does not apply to personal data retained for(a) the prevention, detection, investigation, prosecution or punishment of an offence or breach of law; (b) the national security purposes; (c) the enforcement of a law which imposes a pecumary penalty; (d) the enforcement of legislation relating to public revenue collection; (e) the conduct of proceedings before any court or tribunal ; or (f) historical, statistical, or research purposes. (3) A person who uses personal data of a data subject to make a decision about the data subject shall(a) retain the data for a period required or prescribed by law ; or (b) where no retention period is required by law, retain the data for a period which shall afford the data subject an opportunity to request access to the data .