9. “Data processor” means an individual, private entity, public authority or agency or any other body who or which processes personal data on behalf of or at the direction of a data controller or another data processor; 10. “Data subject” means an individual to whom personal data relates; 11. “Minister” means the Minister of Communications and Technology or such other Minister designated as responsible for data protection; 12. “Personal data” means any information relating to an individual who can be identified or is identifiable, directly or indirectly by reference to an identifier such as a name, an identification number, location data, an online identifier or one or more factors specific to the physical, physiological, genetic, psychological, cultural, social or economic identity of that individual; 13. “Personal data breach” means a breach of security of a data controller or data processor leading to or reasonably likely to lead to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed; 14. “Data processing” means the collection, recording, organisation, storage, alteration, disclosure by transmission, combination, restriction or destruction of personal data by electronic means; and 15. “Sensitive personal data” means personal data relating to an individual’s: a) biometric data; b) race, clan or ethnic origin; c) religious beliefs; d) health status; e) marital status or sex life; or f) political opinions or affiliations; and g) any other category of personal data prescribed by the Authority in regulations as sensitive personal data. Article 3: Objectives The objectives of this Law are to: 1. protect data subjects from risks to data subjects arising from the processing of their personal data, including risks to their rights and liberties under the Constitution of the Federal Republic of Somalia; 2. promote data processing practices that protect the security of personal data and privacy of data subjects; 6