biometric data, data concerning health or data concerning an individual’s sex life or sexual orientation and personal data relating to criminal offences, including criminal records. The processing of such data shall be prohibited or allowed only subject to appropriate safeguards under PART II Section 7 of this Act; “third party” means any natural or legal person, organization or public authority other than the data subject, the controller, the processor and anyone who, under the direct authority of the controller or the processor, is authorised to process the data. 2. 2. Scope and Application of this Act (1) This Act applies to the processing of personal data wholly or partly by automated and by non-automated means, where the personal data form part of a structured set of data and are accessible or retrievable according to specific criteria. (2) This Act protects individuals with regard to the processing of personal data whatever his or her nationality or residence and in particular by; (a) requiring that personal data are processed in a transparent, fair and lawful manner, on the basis of an individual’s consent or another specified lawful basis; (b) conferring on individuals several rights as set out in PART III including the right to access and to know the underlying reasoning of the processing, and the right to the rectification and erasure of their personal data, and the right to remedy. (3) This Act applies to the processing of personal data carried out by controllers, and where applicable processors, in the private and public sectors. (4) This Act applies to the processing of personal data undertaken within the territory of Namibia as well as to the processing of personal data undertaken outside the territory of Namibia where the processing relates to individuals within the jurisdiction of Namibia. (5) This act does not apply to personal data processed by an individual in the course of a purely personal or household activity. Part II BASIC PRINCIPLES AND LAWFUL PROCESSING 3. Basic Principles relating to the processing of Personal Data (1) Fair, transparent and lawful processing (a) Personal data must be processed fairly. (b) Personal data must be processed transparently. Data subjects have the right to know about the processing of their personal data in accordance with Section 8 of this Act. (c) Personal data must be processed lawfully. (2) (a) Specific Legitimate Purpose and Purpose Limitation Personal data must be processed for explicit, specified and legitimate purposes and any further processing must not be incompatible with those specified purposes. 5