or any other personal data as the Commission may determine by order published in the official Gazette; (o) “vital interests” means matters relating to life, death or security of a data subject; 3.​ ​Scope and applicability​.— (1) This Act applies to— (a) any person who processes; and (b) any person who has control over or authorizes the processing of, any personal data relating to Pakistani citizens . (2) Subject to subsection (1), this Act applies to a person in respect of personal data if— (a) the person is established in Pakistan and the personal data is processed, whether or not in the context of that establishment, by that person or any other person employed or engaged by that establishment; and (b) the person is not established in Pakistan, but uses equipment in Pakistan for processing the personal data otherwise than for the purposes of transit through Pakistan. (3) A person falling within clause (b) of subsection (2) shall nominate for the purposes of this Act a representative established in Pakistan. (4) For the purposes of subsections (2) and (3), each of the following is to be treated as established in Pakistan: (a) an individual whose physical presence in Pakistan shall not be less than one hundred and eighty days in one calendar year; (b) a body incorporated under the Companies Act 2017 (Act XIX of 2017); (c) a partnership or other unincorporated association formed under any written laws in Pakistan; and (d) any person who does not fall within paragraph (a), (b) or (c) but maintains in Pakistan— (i) an office, branch or agency through which he carries on any activity; or (ii) a regular practice. (5) It shall not apply to: (a) processing of personal data by a natural person in the course of a purely personal or household activity or family purposes; (b) processing of personal data exclusively for journalistic, artistic or literary purposes subject to the conditions that: (i) the processing is undertaken with a view to the publication by any person of the journalistic, literary or artistic material; (ii) the data controller reasonably believes that, taking into account the special importance of public interest in freedom of expression, the publication would be in the public interest; and (iii) the data controller reasonably believes that in all the circumstances, compliance with the provision in respect of which the exemption is claimed is incompatible with the journalistic, literary or artistic purposes; and 5