Serves under-18s, in Lesotho

Data Protection Act, 2011, ss. 29-37 (sensitive personal information) · Read the law's page

• Do not process personal information concerning a child who is subject to parental control, or a data subject's spiritual, religious or philosophical beliefs, race or ethnic origin, trade union membership, political affiliation, health, sexual life, or criminal behaviour, unless a listed exemption applies.
• Obtain prior parental consent before processing personal information under the parental control exemption, and rely on consent, legal necessity, or Commission authorisation for another listed exemption to the prohibition.
• Where you process a data subject's health or sexual life information under a listed exemption and are not otherwise bound by a confidentiality duty, treat the information as confidential unless required by law or your duties to disclose it.
• Do not supply personal information about a data subject's spiritual, religious or philosophical beliefs, race, trade union membership, or political affiliation to a third party without the data subject's consent, even where a listed exemption lets you process it.
• Apply to the Data Protection Commission for authorisation before processing sensitive personal information in the public interest, and comply with any conditions the Commission imposes on that authorisation.