Protection of Personal Information Act, 2013 (Act No. 4 of 2013)
Chapter 3 : Conditions for Lawful Processing of Personal Information
Part A : Processing of personal information in general
Condition 7 : Security safeguards
20. Information processed by operator or person acting under authority
(a) process such information only with the knowledge or authorisation of the responsible party; and
(b) treat personal information which comes to their knowledge as confidential and must not disclose it,
unless required by law or in the course of the proper performance of their duties.