S7 “sensitive personal information” means – (a) genetic data, data related to children, data related to offences, criminal sentences or security measure, biometric data as well as, if it is processed for what it reveals, personal information revealing racial or ethnic origin, political opinions or affiliations, religious or philosophical beliefs, affiliation, trade-union membership, gender and data concerning health or sex life; or (b) any personal information otherwise considered by the laws of Eswatini as presenting a major risk to the rights and interests of the data subject, in particular unlawful or arbitrary discrimination; “trans-border flow” means any international cross border flows of personal information by means of electronic transmission or any transmission means including data transmission by satellite; and “whistleblowing” means allowing individuals to report the behaviour or conduct of any person which, is considered to be contrary to a law or regulation or fundamental rules. Application 3. This Act applies to – (a) a data controller, data processor whether or not domiciled or having its principal place of business in Eswatini, who uses automated or non-automated means in Eswatini for forwarding personal information; and (b) processing of personal information performed wholly or partly by automated means. Exemptions 4. This Act does not apply to the processing of personal information – (a) in the course of a purely personal or household activity; (b) which has been de-identified to the extent that it cannot be re-identified; (c) by or on behalf of the State and involves national security and defence or public safety; (d) solely for journalistic purposes or the purposes of artistic or literary expression, where the artistic or literary expression are necessary to reconcile the right to privacy with the rules governing freedom of expression; or (e) which has been exempted under this Act. PART II RESPONSIBILITIES OF THE COMMISSION Functions of Commission 5. (1) The Commission shall – (a) administer this Act and protect the respective rights of information privacy provided for under this Act or any other law;