Personal Data Protection Act, No. 9 of 2022 5 7. Every controller shall ensure that personal data that is processed shall be— (a) adequate; Obligation to confine personal data processing to the defined purpose (b) relevant; and (c) proportionate, to the extent as is necessary in relation to the purpose for which such data shall be collected or processed. 8. Every controller shall ensure that personal data that is processed shall be— Obligation to ensure accuracy (a) accurate; and (b) kept up to date, with every reasonable step being taken to erase or rectify any inaccurate or outdated personal data, without undue delay. 9. Every controller shall ensure that personal data that is being processed shall be kept in a form which permits identification of data subjects only for such period as may be necessary or required for the purposes for which such personal data is processed: Obligation to limit the period of retention Provided however, subject to the provisions of section 10 of this Act, a controller may store personal data for longer periods in so far as the personal data shall be processed further for archiving purposes in the public interest, scientific research, historical research or statistical purposes. 10. Every controller shall ensure integrity and confidentiality of personal data that is being processed, by using appropriate technical and organizational measures Obligation to maintain Integrity and confidentiality