Under the DP Law, personal data may only be collected and processed in a lawful, fair, and transparent manner. The key principles include:

• Lawfulness, fairness, and transparency. Processing is lawful only if based on at least one of the following legal grounds:
  • Consent of the data subject for one or more specific purposes,
  • Performance of a contract to which the data subject is a party, or taking steps at the request of the data subject prior to entering into a contract,
  • Legal obligation of the controller,
  • Protection of vital interests of the data subject or another person,
  • Public interest or official authority, i.e., processing necessary for performing a task carried out in the public interest or in the exercise of official powers and
  • Legitimate interests pursued by the controller or a third party, except where overridden by the interests, rights, or freedoms of the data subject (especially if the data subject is a child);
• Purpose limitation. Data must be collected for specified, explicit, and legitimate purposes and not further processed in a manner incompatible with those purposes.
• Data minimization. Only data that are adequate, relevant, and limited to what is necessary for the intended purposes may be collected and processed.
• Accuracy. Controllers are required to ensure that personal data are accurate and kept up to date, and to take reasonable steps to rectify or erase inaccurate data without delay.
• Storage limitation. Personal data must be kept in a form that permits identification of data subjects no longer than necessary for the purposes for which the data are processed.
• Integrity and confidentiality. Appropriate technical and organizational measures must be implemented to ensure the security of personal data, including protection against unauthorized or unlawful processing, accidental loss, destruction, or damage.
• Accountability. Controllers and processors are responsible for demonstrating compliance with these principles, including maintaining internal records of processing activities and cooperating with the Agency.

Processing of special categories of personal data, such as data revealing racial or ethnic origin, political opinions, religious beliefs, health data, or data concerning criminal convictions, is prohibited unless specific conditions are met (e.g., explicit consent, legal obligations, or public interest).

Data subjects’ rights include:

• Right to be informed when personal data are collected, including legal basis and purpose of processing.
• Right of access to their personal data.
• Right to rectification of inaccurate or incomplete data.
• Right to erasure (“right to be forgotten”) in certain circumstances.
• Right to restriction of processing.
• Right to be notified of any rectification, erasure, or restriction of processing.
• Right to data portability.
• Right to object to processing, including for direct marketing purposes.
• Rights related to automated decision-making and profiling.