The DP Law operates on the basis of the principles of lawfulness, fairness and transparency, purpose limitation, data minimization, accuracy, storage limitation, integrity and confidentiality and accountability.

The requirement of carrying out the data processing lawfully means that, amongst other, it should be based upon adequate legal ground. Such legal ground is either a data subject's consent (relating to specified, explicit and legitimate purpose/-s) or one of the remaining grounds explicitly prescribed by the DP Law which include:

• necessity of a particular processing for the performance of a contract to which a data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;
• necessity for compliance with a legal obligation to which the data controller is subject;
• necessity for the protection of the vital interests of the data subject or of another natural person;
• necessity for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller, and
• necessity for realization of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data.

The processing of special categories of personal data is prohibited, unless an exception prescribed with the DP Law applies.

Data subjects are entitled to a range of rights under the DP Law, including right of access, right to rectify, right to erasure (‘right to be forgotten’), right to restriction of processing, right to data portability, right to object, right not to be subject to automated decision making, including profiling.