IT is the policy of the state to protect the fundamental human right of privacy of communication while ensuring free flow of information to promote innovation and growth (Section 2, Data Privacy Act of 2012). Thus, the processing of sensitive personal information is generally prohibited.

Section 13 of the Data Privacy Act (DPA), however, provides for exceptions. Section 13 (f), in particular, allows processing of such information if it is 'necessary for the protection of lawful rights and interests of natural or legal persons in court proceedings, or the establishment, exercise or defense of legal claims, or when provided to government or public authority.'