(a) processed lawfully, fairly and in a transparent manner in relation to any data subject; (b) collected for explicit, specified and legitimate purposes and not further processed in a manner incompatible with those purposes; (c) adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed; (d) accurate and, where necessary, kept up to date, with every reasonable step being taken to ensure that any inaccurate personal data are erased or rectified without delay; (e) kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; and (f) processed in accordance with the rights of data subjects. 22. Duties of controller (1) Every controller shall adopt policies and implement appropriate technical and organisational measures so as to ensure and be able to demonstrate that the processing of personal data is performed in accordance with this Act. (2) The measures referred to in subsection (1) shall include –