No. 24 of 2019 Data Protection [Subsidiary] (d) the data controller or data processor merges several purposes for processing without seeking specific consent for each purpose; or (e) the intention of the data subject is ambiguous. (5) Where the data subject withdraws consent to any part of the processing, the data controller or data processor shall restrict the part of the processing in respect of which consent is withdrawn, subject to section 34 of the Act. 5. Lawful basis for processing (1) A data controller or data processor may process data without consent of a data subject if the processing is necessary for any reason set out in section 30(1) (b) of the Act. (2) Processing under sub-regulation (1) shall only rely on one legal basis for processing at a time, which shall be established before the processing. (3) The legal basis relied on under sub-regulation (1) shall be demonstrable at all times and where a data controller uses multiple bases for different processing, the data controller shall— (a) distinguish between the legal bases being used; and (b) respond to any data subject rights requests. 6. Mode of collection of personal data (1) Pursuant to section 28(2) of the Act, a data controller or data processor may collect personal data indirectly from— (a) any person other than the data subject; (b) publications or databases; (c) surveillance cameras, where an individual is identifiable or reasonably identifiable; (d) information associated with web browsing; or (e) biometric technology, including voice or facial recognition. (2) A data controller or data processor shall, in collecting personal data— (a) ensure that processing is limited to personal data which the data subject has permitted the data controller or data processor to collect; (b) undertake steps to ensure that personal data is accurate, not in excessive and up to date; (c) undertake processes to secure personal data; and (d) comply with the lawful processing principles set out under Part IV of the Act. (3) Where a data controller or data processor collects personal data indirectly, the data controller or data processor shall within fourteen days inform the data subject of the collection. (4) Where a data controller or data processor intends to use personal data for a new purpose, the data controller or data processor shall ensure that the new purpose is compatible with the initial purpose for which the personal data was collected. (5) Where the new purpose is not compatible with the initial purpose, a data controller or data processor shall seek fresh consent from the data subject in accordance with regulation 4. 7. Restriction to processing (1) Pursuant to section 34 of the Act, a data subject may request a data controller or data processor to restrict the processing of their personal data on grounds that— (a) the data subject contests the accuracy of their personal data; (b) the personal data has been unlawfully processed and the data subject opposes the erasure and requests restriction instead; 20