(ll) “Significant” means any data controller or processor which is sufficiently great or important to be worthy of attention by its sales revenue, profit, number of employees, market share, capital employed, or any other indicator such as number of users, type of data collected or a combination thereof that may constitute it as significant; (mm)“ The State” means the same as defined under Article 7 of the Constitution of the Islamic Republic of Pakistan, 1973; (nn) “third party “means any person other than— (i) a data subject; (ii) a relevant person concerning a data subject; (iii) a data controller; (iv) a data processor; or (v) a person under the direct control of the data controller, who is authorised in writing to process the personal data; (oo) “vital interests” means matters relating to life, fundamental rights, security of data subject to humanitarian emergencies, in particular in situations of natural and man-made disasters, and monitoring and management of epidemics. 3. Scope and applicability. – This Act shall apply– (a) Where any data controller or a data processor processes or exercises control or authorises the processing of any personal data, provided that they shall be established/present/registered within the territory of Pakistan. (b) Where any data controller or a data processor whether digitally or non-digitally operational within Pakistan but incorporated in any other jurisdiction, carries out processing of personal data concerning any commercial or non-commercial activity including profiling data subjects within the territory of Pakistan. (c) Where a data controller and a data processor not having a physical presence within the territory of Pakistan carries out the processing of personal data in a territory where Pakistani law applies under public or private international law. 11