4 Obligation to process personal data in a lawful manner Personal Data Protection Act, No. 9 of 2022 5. The processing of personal data shall be lawful if a controller is in compliance with— (a) any condition specified in Schedule I hereto; (b) any condition specified in Schedule II hereto in the case of processing special categories of personal data; (c) all the conditions specified in Schedule III hereto in the case of processing personal data based on the consent of the data subject under item (a) of Schedule I or under item (a) of Schedule II hereto; or (d) all the conditions specified in Schedule IV hereto in the case of processing personal data in respect of criminal investigations. Obligation to define a purpose for personal data processing 6. (1) Every controller shall, ensure that personal data is processed for a— (a) specified; (b) explicit; and (c) legitimate, purposes and such personal data shall not be further processed in a manner which is incompatible with such purposes. (2) Subject to the provisions of section 10 of this Act, further processing of such personal data by a controller for archiving purposes in the public interest, scientific research, historical research or statistical purposes shall not be considered to be incompatible with the initial purposes referred to in paragraphs (a), (b) and (c) of subsection (1).