(c) processing of personal data by a government entity solely for the purposes and to the extent provided under the relevant Act of the Parliament subject to the condition of ensuring security and secrecy for the protection and confidentiality of personal data; Provided that the provisions of this Act shall apply to processing of personal data for commercial purposes by a government entity. CHAPTER II PROCESSING OF PERSONAL DATA AND OBLIGATIOINS OF THE DATA CONTROLLER AND DATA PROCESSORS 4. ​Protection of personal data​.— The processing of personal data shall only be done in compliance with the provisions of this Act. 5. General requirements for personal data processing.- ​(1) ​A data controller shall not process personal data including sensitive personal dataof a data subject unless the data subject has given his consent to the processing of the personal data. (2) Notwithstanding sub-section (1) , a data controller may process personal data about a data subject if the processing is necessary— (a) for the performance of a contract to which the data subject is a party; (b) for the taking of steps at the request of the data subject with a view to entering into a contract; (c) for compliance with any legal obligation to which the data controller is the subject, other than an obligation imposed by a contract; (d) in order to protect the vital interests of the data subject; (e) for the administration of justice pursuant to an order of the court of competent jurisdiction; (f) for legitimate interests pursued by the data controller; or (g) for the exercise of any functions conferred on any person by or under any law. (3) Personal data shall not be processed unless— (a) the personal data is processed for a lawful purpose directly related to an activity of the data controller; (b) the processing of the personal data is necessary for or directly related to that purpose; and (c) the personal data is adequate but not excessive in relation to that purpose. 6. Notice to the data subject.- ​(1) A data controller shall by written notice inform a data subject— (a) that personal data of the data subject is being processed by or on behalf of the data controller, and shall provide a description of the personal data to that data subject; (b) the legal basis for the processing of personal data and time duration for which data is likely to be processed and retained thereafter; the purposes for which the personal data is being or is to be collected and further processed; 6