25. The second standard 

25.—

1. The second standard is that personal data shall be obtained only for one or more specified and lawful purposes, and shall not be further processed in any manner incompatible with those purposes.

2. The purpose or purposes for which personal data are processed may in particular be specified—

(a) in information provided for the purposes of section 22(6); or

(b) in particulars given to the Commissioner under section 16.

3. In determining whether any disclosure of personal data is compatible with the purpose for which the data were obtained, regard shall be had to the purpose for which the personal data are intended to be processed by any person to whom they are disclosed.