Article 18. Conditions for the processing of personal data

The processing of personal data should be carried out in accordance with the basic principles of this Law.

The processing of personal data is carried out in the following cases:

subject's consent to the processing of this data;

the need to process this data in order to fulfill the contract to which the subject is a party, or to take measures at the request of the subject before concluding such a contract;

the need to process this data to fulfill the obligations of the owner and (or) operator as defined by law;

the need to process this data to protect the legitimate interests of the subject or other person;

the need to process this data in order to exercise the rights and legitimate interests of the owner and (or) operator or a third party or to achieve socially significant purposes, provided that this does not violate the rights and legitimate interests of personal data subjects;

processing of these data for statistical or other research purposes, subject to the mandatory anonymization of personal data;

if this data is obtained from publicly available sources.

If it is necessary to process personal data in order to protect the rights and legitimate interests of the subject, their processing is allowed without the consent of the subject until the time it becomes possible to obtain consent.