315 The Data Protection Bill, 2018 appropriate technical and organizational measures shall be taken to safeguard the data subject against the risk of loss, damage, destruction of or unauthorized access to personal information; and data subjects have a right of access to their personal information and a right to demand correction if such information is inaccurate. 5. Every person has the right to privacy with respect to their personal data. Right to protection of privacy. 6. (1) The right to privacy under Article 31 of the Constitution, with respect to personal data, may be limited for the purpose of safeguarding overriding legitimate interests. (2) The right to privacy may be limited for purposes of Limitation. national security; prevention, detection, investigation, prosecution or punishment of a crime; safeguarding rights of the data subject or another person; public interest; and compliance with an obligation imposed by law. 7. (1) An agency shall, subject to subsection (2), where it requires personal data from a person, collect such information directly from the data subject for a purpose which is specific, explicitly defined and lawful. (2) An agency shall not be required to collect personal data directly from a data subject where the data is a matter of public record; the data subject or a competent person, where the data subject is a child, has consented to the collection from another source; the data subject has consented to the collection from another source; collection from another source would not prejudice the interests of the data subject; collection of data from another source is necessary- Collection of data from data subject.