j) k) l) m) n) o) 3 3.1 who is below the age of 18 years, the parent or a guardian appointed by a court of competent jurisdiction; (b) in case of a data subject who is incapable of managing his own affairs, a person who is appointed by a court to manage those affairs; or (c) a person authorized by the data subject to make a data access and/or data correction request. “rules” means rules made under this Act; and “sensitive personal data” means and includes data relating to access control (username and/or password), financial information such as bank account, credit card, debit card, or other payment instruments, and, passports, biometric data, and physical, psychological, and mental health conditions, medical records, and any detail pertaining to an individual’s ethnicity, religious beliefs, or any other information for the purposes of this Act and rules made thereunder. ”consent” of the data subject means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the collecting, obtaining and processing of personal data relating to him or her; “pseudonymisation” means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organizational measures to ensure that the personal data are not attributed to an identified or identifiable natural person; “vital interests” means matters relating to life, death or security of a data subject; “Authority" means the Personal Data Protection Authority (PDPA) established under section [32] of the Act;“Critical Personal Data” -- to be classified by the Authority with the approval of the Federal Government. SCOPE AND APPLICABILITY. This Act applies to— a) any person who processes; or has control over or authorizes the processing of, any personal data provided any of the data subject, controller, or processor (either local or foreign) is located in Pakistan.; Subject to subsection (1),This Act applies to a person in respect of personal data if— 3.2 A data controller or processor falling within clause (a) of subsection (1) not registered/established in Pakistan shall nominate for the purposes of this Act a representative in Pakistan. 3.3 For the purposes of subsections (2) and (3), each of the following is to be treated as established in Pakistan: a) an individual whose physical presence in Pakistan shall not be less than one hundred and eighty days in one calendar year; b) a body incorporated under the Companies Act 2017 (Act XIX of 2017); c) a partnership or other unincorporated association formed under any written laws in Pakistan; and d) any person who does not fall within paragraph (a), (b) or (c) but maintains in Pakistan— (i) an office, branch or agency through which he carries on any activity; or 5