(xii) religiousor political belief or affiliation; or (xiii) any other category of data specified by the Authority under section 22. (36) “Significant data fiduciary”means a data fiduciary notified by the Authority under section 38; (37) “Significant harm”means harm that has an aggravated effect having regard to the nature of the personal data being processed,the impact, continuity, persistence or irreversibility of the harm; (38) “Specified” means specified by regulations made by the Authority under this Act and the term “specify” shall be construed accordingly; (39) “State” shall, unless the context otherwise requires, have the same meaning assigned to itunder Article 12 of the Constitution; (40) “Systematic activity” means any structured or organised activity that involves an element of planning, method, continuity or persistence; (41) “Transgender status”means the condition of a data principal whose sense of gender does not match with the gender assigned to that data principal at birth, whether or not they have undergone sex reassignment surgery, hormone therapy, laser therapy, or any other similar medical procedure. CHAPTER II DATA PROTECTION OBLIGATIONS 4. Fair and reasonable processing.—Any person processing personal data owes a duty to the data principal to process such personal data in a fair and reasonable manner that respects the privacy of the data principal. 5. Purpose limitation.— (1) Personal data shall be processed only for purposes that are clear, specific and lawful. (2) Personal data shall be processed only for purposes specified or for any other incidental purpose that the data principal would reasonably expect the personal data to be used for, having regard to the specified purposes, and the context and circumstances in which the personal data was collected. 6