(1) The Authority may process personal data, including special categories of personal data, in accordance with the General Data Protection Regulation and the Act of 2018 and any regulations under section 112 where necessary and proportionate for the performance of its functions under this Act.

(2) Subject to subsection (3), a service provider may process personal data, including special categories of personal data, in accordance with the General Data Protection Regulation and the Act of 2018 and any regulations under section 112 where necessary and proportionate for the performance of his, her or its functions under this Act.

(3) A service provider may not process personal data in accordance with Part 5 of the Act of 2018.

(4) For the purposes of this Act, the Authority is designated as controller in relation to personal data processed by it for the purposes of the performance of its functions under this Act, and shall put in place appropriate data processing contracts, where necessary, with each service provider.