Sometimes controllers may process personal data without the consent of the citizens.

These exceptions are related to different situations:

  • execution of a contract in which the data subject is the agreement party or at a request of the data subject before his access to the contract;
  • necessary fulfillment of the legal obligation of the controller;
  • to protect the life and physical and moral integrity of the personal data subject;
  • pursuit of matters of public interest or official authority of the controller or a third party to whom the data are disclosed;
  • to protect the security and defense of the state;
  • for prevention, detection and prosecution of offenders;
  • for protection from violation of ethical rules of a particular profession;
  • for protection of important economic or financial interests of the state and
  • for historical and scientific research and statistical purposes.

Specific exceptions set out in Article 8 paragraph 2 of the Law on protection of personal data, are provided for the processing of special categories of personal data.

Processing of personal data related to criminal offenses, sentences and security measures on criminal charges may be performed only by competent state authority in accordance with law.