If the data concerns patient record documents, it must be treated as sensitive data as provided for in the Personal Data Protection Act. Personal data should be processed with explicit consent of the data subject, except where the laws provide otherwise. Data processing concerning special circumstances may be referred to the PDPB for review.