18 Laws of Malaysia ACT 709 (2) Notwithstanding paragraph (1)(a), a data user may process personal data about a data subject if the processing is necessary— (a) for the performance of a contract to which the data subject is a party; (b) for the taking of steps at the request of the data subject with a view to entering into a contract; (c) for compliance with any legal obligation to which the data user is the subject, other than an obligation imposed by a contract; (d) in order to protect the vital interests of the data subject; (e) for the administration of justice; or (f) for the exercise of any functions conferred on any person by or under any law. (3) Personal data shall not be processed unless— (a) the personal data is processed for a lawful purpose directly related to an activity of the data user; (b) the processing of the personal data is necessary for or directly related to that purpose; and (c) the personal data is adequate but not excessive in relation to that purpose. Notice and Choice Principle 7. (1) A data user shall by written notice inform a data subject— (a) that personal data of the data subject is being processed by or on behalf of the data user, and shall provide a description of the personal data to that data subject; (b) the purposes for which the personal data is being or is to be collected and further processed; (c) of any information available to the data user as to the source of that personal data; (d) of the data subject’s right to request access to and to request correction of the personal data and how to contact the data user with any inquiries or complaints in respect of the personal data;