Article 107 PDPA
Unlawful processing of personal data

1. Anyone who processes personal data, although its processing is not authorized or he is not authorized to process it, is subject to a fine, restriction of freedom or imprisonment for up to two years.

2. If the act specified in paragraph 1 involves data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data processed for the purpose of uniquely identifying a natural person, data concerning health, sexuality or sexual orientation, shall be punishable by a fine, restriction of freedom or imprisonment for up to three years.