(1) A data controller to whom section 16 of this Act applies shall not keep personal data unless there is for the time being an entry in the register in respect of him.
(2) A data controller in respect of whom there is an entry in the register shall not -
(a) keep personal data of any description other than that specified in the entry,
(b) keep or use personal data for a purpose other than the purpose or purposes described in the entry,
(c) if the source from which such data, and any information intended for inclusion in such data, are obtained is required to be described in the entry, obtain such data or information from a source that is not so described,
(d) disclose such data to a person who is not described in the entry (other than a person to whom a disclosure of such data may be made in the circumstances specified in section 8 of this Act),
(e) directly or indirectly transfer such data to a place outside the State other than one named or described in the entry.
(3) An employ