The Personal Data Protection Act protects and regulates the processing, use, amendment and archiving of personal data by institutions and individuals. As long as the staffs who handle the personal data are duly authorized, there is no mandatory requirement to record every step of the process under normal circumstances.