Data Protection No. 5/2021 Cap. 11:22 PART IV General Rules on the Processing of Data 8 Generality 9 Purpose The data controller shall ensure that the processing of data is necessary and that the data is processed fairly and lawfully. (1) The data controller shall ensure that data is collected for specified, explicit and legitimate purposes and, taking into account all relevant factors, especially the reasonable expectations of the data subject and the applicable legal and regulatory provisions, that the data is not further processed in a way incompatible with such purposes. (2) Under the conditions established by the Authority, further processing of data for historical, statistical or scientific research purposes is not considered incompatible. 10 Non-sensitive data (1) Personal information may only be processed if the data subject or a competent person, where the data subject is a child, consents to the processing of such data. (2) The consent referred to in subsection (1) may be implied where the data subject is an adult natural person or has a legal persona and has full legal capacity to consent. (3) The processing of non-sensitive data is permitted, without the consent of the data subject, where necessary for purposes of— (a) being material as evidence in proving an offence; or (b) compliance with an obligation to which the controller is subject by or by virtue of a law; or (c) protecting the vital interests of the data subject; or (d) performing a task carried out in the public interest, or in the exercise of the official authority vested in the controller, or in a third party to whom the data is disclosed; or (e) promoting the legitimate interests of the controller or a third party to whom the data is disclosed, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject claiming protection under this Act. (4) The Authority may specify the circumstances in which the condition stipulated under subsection (3)(e) are considered as having been met. 11 Sensitive information (1) No data controller shall process sensitive data unless the data subject has given consent in writing for such processing; (2) The consent to the processing of data may be withdrawn by the data subject at any time and without any explanation and free of charge; (3) The Authority shall determine the circumstances in which the prohibition to process the data referred to in this subsection (1) cannot be lifted even with the data 48 DISTRIBUTED BY VERITAS e-mail: veritas@mango.zw; website: www.veritaszim.net Veritas makes every effort to ensure the provision of reliable information, but cannot take legal responsibility for information supplied.