Section 3
Application of Order
of Personal Data Protection Order, 2025
(1)
Parts 3, 4, 5, 6 and 7 do not impose any obligation on-
(a} any individual acting in a personal or domestic capacity;
(b)
any employee acting in the course of his employment with an organisation;
(c)
any public agency; or
(d)
any other organisations or personal data, or classes of organisations or personal data, prescribed for the purposes of this provision.
(2)
Parts 3, 4, 5, 6 (except sections 22, 23 and 24) and 7 (except sections 27(2)(a} and 29) do not impose any obligation on a data processor in respect of its processing of personal data on behalf of and for the purposes of another organisation pursuant to a contract which is evidenced or made in writing.
(3)
An organisation has the same obligation under this Order in respect of personal data processed on its behalf and for its purposes by a data processor as if the personal data were processed by the organisation itself.
(4)
This Order does not apply in respect of-
(a} personal data about an individual that is contained in a record that has been in existence for at least 100 years; or
(b)
personal data about a deceased individual, except that the provisions relating to the disclosure and protection of personal data apply in respect of personal data about an individual who has been dead for 10
years or fewer.
(5)
Except where business contact information is expressly referred to,
Parts 3, 4, 5, 6 and 7 do not apply to business contact information.
(6)
Unless otherwise expressly provided in this Order-
(a} nothing in Parts 3, 4, 5, 6 and 7 affects any authority, right, privilege or immunity conferred, or obligation or limitation imposed, by or under the law, including legal privilege, except that the performance of a contractual obligation is not an excuse for contravening this Order; and
(b)
the provisions of any other written law prevail to the extent that any provision of Parts 3, 4, 5, 6 and 7 is inconsistent with the provisions of that other written law.
ADMINISTRATION