Article 4 — Lawfulness of Processing

1. 1.

   Processing of personal data shall be lawful only if, and to the extent that, at least one of the following conditions is met:

   1. the data subject has given consent to the processing of his or her personal data for one or more specified purposes;
   2. the processing is necessary for the performance of a contract to which the data subject is a party, or in order to take steps at the request of the data subject prior to entering into a contract;
   3. the processing is necessary for compliance with a legal obligation to which the controller is subject under Kaharagian law or, where applicable, the mandatory law of a host jurisdiction;
   4. the processing is necessary to protect the vital interests of the data subject or of another natural person;
   5. the processing is necessary for the purposes of the legitimate interests pursued by the State, its organs, or a Kaharagian legal person, except where such interests are overridden by the fundamental rights and freedoms of the data subject.
2. 2.

   Where processing is based on consent, the controller shall be able to demonstrate that the data subject has consented to the processing. Consent shall be given by a clear affirmative act establishing a freely given, specific, informed, and unambiguous indication of the data subject’s agreement. Silence, pre-ticked boxes, or inactivity shall not constitute consent.

3. 3.

   The data subject shall have the right to withdraw consent at any time. The withdrawal of consent shall not affect the lawfulness of processing carried out on the basis of consent before its withdrawal. Prior to giving consent, the data subject shall be informed of the right to withdraw. Withdrawal of consent shall be as easy to effect as its grant.

4. 4.

   Where the processing of personal data is based on the legitimate interests of the State or a Kaharagian legal person under paragraph 1(e), the controller shall conduct and document a balancing assessment, weighing the interests pursued against the rights and freedoms of the data subject, having particular regard to the reasonable expectations of the data subject.

5. 5.

   The processing of sensitive personal data as defined in Article 2(1)(b) shall be prohibited unless:

   1. the data subject has given explicit consent to the processing for one or more specified purposes;
   2. the processing is necessary for reasons of substantial public interest under Kaharagian law, on the basis of provisions that are proportionate to the aim pursued and that provide appropriate safeguards for the rights of the data subject;
   3. the processing is necessary to protect the vital interests of the data subject or of another natural person where the data subject is physically or legally incapable of giving consent;
   4. the processing relates to personal data which has been manifestly made public by the data subject;
   5. the processing is necessary for the establishment, exercise, or defence of legal claims before Kaharagian authorities or tribunals.