Where personal data relating to a data subject is collected from the data subject, the data controller must, at the time when personal data is obtained, provide the data subject with the following:

• the identity and the contact details of the data controller and, where applicable, of the data controller's representative;
• the contact details of the data privacy officer, where applicable;

Processingof personal data is only lawful where:

• the data subject has given consent to the processing of his personal data for one or more specific purposes; or 
• the processing is necessary
  
  
  • for the performance of a contract to which the data subject is a party;
  • for the taking of steps at the request of the data subject with a view to entering into a contract;
  • for compliance with any legal obligation to which the data controller is subject, other than an obligation imposed by contract;
  • in order to protect the vital interests of the data subject;
  • for the administration of justice;
  • for the exercise of any functions of either House of Parliament;
  • for the exercise of any functions conferred on any person by or under any enactment;
  • for the exercise of any functions of a public authority;
  • for the purposes of legitimate interests pursued by the data controller or by the third party to whom the data is disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject; or
  • processing is necessary for the purposes of the legitimate interests pursued by the data controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.