Protection of Personal Information Act - Section 9

"Personal information must be processed

(a) lawfully, and

(b) In a reasonable manner that does not infringe the privacy of the data subject ".


So, what is the purpose?

Business process descriptions provide the context for processing personal information – i.e. the specific purpose.

Data collection must be proportionate to the purpose – minimal .

Data processing must be for a legitimate purpose.