1. Personal information may only be processed if:

  a. the data subject or a competent person where the data subject is a child consents to the processing;

  b. processing is necessary to carry out actions for the conclusion or performance of a contract to which the data subject is party;

  c. processing complies with an obligation imposed by law on the responsible party;

  d. processing protects a legitimate interest of the data subject;

  e. processing is necessary for the proper performance of a public law duty by a public body; or

  f. processing is necessary for pursuing the legitimate interests of the responsible party or of a third party to whom the information is supplied.

2. Personal information may only be processed if:

  a. The responsible party bears the burden of proof for the data subject’s or competent person’s consent as referred to in subsection (1)(a).

  b. The data subject or competent person may withdraw his, her or its consent, as referred to in subsection (1)(a), at any time: Provided that the lawfulness of the processing of personal information before such withdrawal or the processing of personal information in terms of subsection (1)(b) to (f) will not be affected.

3. A data subject may object, at any time, to the processing of personal information:

  a. in terms of subsection (1)(d) to (f), in the prescribed manner, on reasonable grounds relating to his, her or its particular situation, unless legislation provides for such processing; or

  b. for purposes of direct marketing other than direct marketing by means of unsolicited electronic communications as referred to in section 69.

4. If a data subject has objected to the processing of personal information in terms of subsection (3), the responsible party may no longer process the personal information.