Article 7 — Lawfulness of Processing

1/ Notwithstanding the provision of Sub-Article (1) of Article 6 of this Proclamation, personal data shall not be processed unless there is compliance with at least one of the conditions set out in Sub-Articles (2) and (3) of this Article; or in the case of sensitive personal data, Article 9 of this Proclamation. 2/ The processing of personal data shall be regarded as lawful when:- a) The data subject has given his consent; b) Processing is necessary and is related to the fulfillment of a contract with the data subject or in order to take steps at the request of the data subject prior to entering into a contract; c) The processing is necessary for compliance with a legal obligation to which the data controller is subject; d) The processing is necessary to protect vitally important interests of the data subject, including life and health; e) The processing is necessary in order to respond to a public health crisis or national emergency or to fulfill functions of public authority which necessarily includes the processing of personal data for the fulfillment of its mandate within the limits of a law issued for this purpose; or f) The processing is necessary for the purposes of the legitimate interests pursued by the personal data controller to whom the data is disclosed, except where such interests are overridden by fundamental rights and freedoms of the data subject which require protection of personal data. 3/ For the purpose of Sub-Article (2) lit. (e) of this Article, a) The impact of data proceccing on privacy right of the data subject shall be necessary and proportionate; b) The law shall determine the essential elements of processing such as the categories of data, the purpose, storage period, and possible disclosure; and c) Further processing of personal data after the expiry of such law shall be prohibited. 4/ The data processing should be proportionate to the legal aim it complies.