324 The Data Protection Bill, 2018 a school processing the information for purposes of providing special support for students in connection with their health; a public or private body acting under a lawful duty to manage the welfare of a data subject; or an administrative body, pension fund, or employer processing information for purposes of implementation of the law relating to the health of the data subject. 29. An agency shall not process personal data of a child unless the processing iscarried out with the prior consent of the parent or guardian or any other person having the authority to make decisions on behalf of the child; necessary to comply with the law; for research or statistical purposes; or publicly available. 30. An agency may process personal information concerning a data subject's political persuasion if the agency is a political party formed under the Political Parties Act or public entity whose functions are political in nature and the personal informationrelates to the members of the agency; and is necessary to the formation or carrying out of the activities of the agency. 31. An agency shall not transfer personal data of a data subject outside the territory of the Republic of Kenya unlessthe third party is subject to a law or agreement that requires the putting in place of adequate measures for the protection of personal data; the data subject consents to the transfer; the transfer is necessary for the performance or conclusion of a contract between the agency and the third party; and the transfer is for the benefit of the data subject. PART IV—OVERSIGHT AND ENFORCEMENT 32. The Commission shall oversee the implementation of and be responsible for the enforcement of this Act. Personal data of children. Data subiect's Political No. Ilof 2011. Transborder flow of personal data. Role of the Commission.