100 No. 3 of 2021] Data Protection PART IV PRINCIPLES AND RULES RELATING TO PROCESSING OF PERSONAL DATA Principles relating to processing of personal data 12. (1) A data controller or data processor shall ensure that personal data is— (a) processed lawfully, fairly and transparently; (b) collected for explicit, specified and legitimate purposes and not further processed in a manner incompatible with those purposes; (c) adequate, relevant and limited to what is necessary in relation to the purposes for which it is processed; (d) accurate and where necessary, kept up to date, with every reasonable step taken to ensure that any inaccurate personal data is erased or rectified without delay; (e) stored in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data is processed; (f) processed in accordance with the rights of a data subject; and (g) processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against any loss, destruction or damage, using appropriate technical or organisational measures. (2) For the purposes of subsection 1(b), processing of personal data for purposes of archiving in the public interest, scientific or historical research purposes or statistical purposes shall not be considered to be incompatible with the initial purpose. Processing of personal data 13. Subject to the other provisions of this Act, a data controller may process personal data where— (a) the data subject has given consent to the processing of that data subject’s personal data; (b) the processing is necessary— (i) for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract; (ii) for compliance with a legal obligation to which the data controller is subject;