S2 PART III PROCESSING OF PERSONAL INFORMATION 9. Processing of personal information 10. Collection of personal information from data subject 11. Collection of personal information by data controller 12. Purpose specification and further processing limitation 13. Retention of records 14. Security measures on integrity of personal information 15. Processing of Information by data processor on behalf of data controller 16. Security measures for information processed by a data processor 17. Notification of security compromises 18. Quality of information 19. Access to and challenging of personal information 20. Correction of personal information 21. Data controller to give effect to principles of this Act 22. Prohibition against processing of sensitive personal information PART IV EXEMPTIONS FROM PROTECTION ON PROCESSING OF PERSONAL INFORMATION 23. Exemption on spiritual, religious or philosophical beliefs of data subject 24. Exemption on race of data subject 25. Exemption on trade union membership 26. Exemption on political affiliation of data subject 27. Exemption on health or sexual life of data subject 28. Exemption on criminal behaviour of data subject 29. General exemption on sensitive personal information 30. Authorisation by the Commission 31. Exemption for processing of personal data for historical, statistical and research purposes