4 Data Protection Act, 2018 - 5. (a) the person is established in Saint Christopher and Nevis and the personal data is processed, whether or not in the context of that establishment, by that person or any other person employed or engaged by that establishment; or (b) the person is not established in Saint Christopher and Nevis, but uses equipment in Saint Christopher and Nevis for processing the personal data otherwise than for the purposes of transit through Saint Christopher and Nevis. (3) A person falling within paragraph (2)(b) shall nominate for the purposes of this Act a representative established in Saint Christopher and Nevis. (4) For the purposes of subsections (2) and (3), each of the following is to be treated as established in Saint Christopher and Nevis: (a) an individual whose physical presence in Saint Christopher and Nevis shall not be less than one hundred and eighty days in one calendar year; (b) a body incorporated under the Companies Act, Cap 21.03; (c) a partnership or other unincorporated association formed under any written laws in Saint Christopher and Nevis; and (d) a person who does not fall within paragraph (a), (b) or (c) but maintains in Saint Christopher and Nevis – (i) an office, branch or agency through which he or she carries on any activity; or (ii) a regular professional practice. 5. Saving of certain laws. This Act shall not affect the operation of a law that makes provision with respect to the processing of personal data and is capable of operating concurrently with this Act. 6. Act to bind the State. This Act shall bind the State. PART II PRIVACY AND DATA PROTECTION PRINCIPLES 7. General Principle. (1) A data user shall not– (a) in the case of personal data other than sensitive personal data, process personal data about a data subject unless the data subject has given his or her consent to the processing of the personal data; or (b) in the case of sensitive personal data, process sensitive personal data about a data subject except in accordance with the provisions of section 20. (2) Notwithstanding paragraph (1)(a) and subject to subsection (3), a data user may process personal data about a data subject if the processing is necessary– (a) for the performance of a contract to which the data subject is a party;