19 2019 Data Protection No. (ii) for the enforcement of a law which imposes a pecuniary penalty; or (iii) for the protection of the interests of the data subject or another person. (3) A data controller or data processor shall collect, store or use personal data for a purpose which is lawful, specific and explicitly defined. 29. A data controller or data processor shall, before collecting personal data, in so far as practicable, inform the data subject of — Duty to notify. (a) the rights of data subject specified under section 26; (b) the fact that personal data is being collected; (c) the purpose for which the personal data is being collected; (d) the third parties whose personal data has been or will be transferred to, including details of safeguards adopted; (e) the contacts of the data controller or data processor and on whether any other entity may receive the collected personal data; (f) a description of the technical and organizational security measures taken to ensure the integrity and confidentiality of the data; (g) the data being collected pursuant to any law and whether such collection is voluntary or mandatory; and (h) the consequences if any, where the data subject fails to provide all or any part of the requested data. 30. (1) A data controller or data processor shall not process personal data, unless— (a) the data subject consents to the processing for one or more specified purposes; or (b) the processing is necessary— (i) for the performance of a contract to which the data subject is a party or in order to take Lawful processing of personal data. !