Processing is defined under the PDPL as any operation or set of operations carried out on personal data by automated or non-automated means, such as collecting, recording, organizing, classifying in groups, storing, modifying, amending, retrieving, using or revealing such data by broadcasting, publishing, transmitting, making them available to others, integrating, blocking, deleting or destroying them.

Processing of personal data can only occur with the consent of the data subject, unless the processing is necessary:

• to implement a contract to which the data subject is a party;
• to take steps at the request of the data subject to conclude a contract;
• to implement an obligation required by law, contrary to a contractual obligation or an order from a competent court;
• to protect the vital interests of the data subject; or
• to exercise the legitimate interests of the data controller or any third party to whom the data is disclosed, unless this conflicts with the fundamental rights and freedoms of the data subject.

Processing of sensitive personal data is also prohibited without the consent of the data subject, except when the processing:

• is required by the data controller to carry out their obligations;
• is necessary for the protection of the data subject;
• of the data is made available to the public by the data subject;
• is necessary to exercise any of the procedures of claims of legal rights or the defence thereof;
• is necessary for the purposes of preventive medicine, medical diagnosis, provision of healthcare, treatment or management of healthcare services;
• is carried out within the activities of associations, unions and other non-profit organisations;
• is carried out by a competent public entity; or
• is related to the race or ethnicity, if they are necessary to ascertain equal opportunities or treatment of the society's individuals.

Data controllers are prohibited from processing the following personal data types without the prior written authorization of the Authority:

• automatic processing of sensitive personal data of data subjects who cannot provide consent;
• automatic processing of biometric data;
• automatic processing of genetic data (unless such processing was provided by physicians and specialists at a licensed medical establishment and is necessary for purposes of preventative medicine or diagnostic medicine, or purposes to provide treatment or healthcare);
• automatic processing of personal data files that are in the possession of two or more data controllers that are processing personal data for different purposes; or
• processing that consists of visual recording to be used for monitoring purposes.