No. 136 Chapter 69 Gor Government Gazette 27 May 2019 mutandis to the withdrawal of consent of the data subject, the notice given to the data subject, the exercise of rights of the data subject, the complaint of the data subject, and any other acts under this Act for the data subject who is a minor, a n incompetent or quasiincompetent person. Section 21 The Data Controller shall collect, use, or disclose Personal Data according to the purpose notified to the data subject prior to or at the time of such collection. The collection, use, or disclosure of Personal Data shall not be conducted in a manner that is different from the purpose previously notified to the data subject in accordance with paragraph one, unless: (1) the data subject has been informed of such new purpose, and the consent is obtained prior to the time of collection, use, or disclosure; or (2) it can be done by the provisions of this Act or in other laws. Part 2 Personal Data Collection --------------------------Section 22 The collection of Personal Data shall be limited to the extent necessary in relation to the lawful purpose of the Data Controller. Section 23 In collecting the Personal Data, the Data Controller shall inform the data subject, prior to or at the time of such collection, of the following details, except the case where the data subject already knows of such details: (1) the purpose of the collection for use or disclosure of the Personal Data, including the purpose which is permitted under Section 24 for the collection of Personal Data without the data subject's consent; (2) notification of the case where the data subject must provide his or her Personal Data for compliance with a legal obligation, or for the performance of the contract, or where it is necessary to provide the Personal Data for the purpose of entering into the contract, including notification of the possible effect where the data subject does not provide such Personal Data. (3) the Personal Data to be collected and the period for which the Personal Data will be retained. If it is not possible to specify the retention period, the expected data retention period according the data retention standard shall be specified; (4) the categories of Persons or entities to whom the collected Personal Data may be disclosed; (5) information, address and the contact channel details of the Data Controller, where applicable, of the Data Controller's representative or data protection officer; and 10