In order to fulfil its statutory duty, the Oversight Authority may process personal data and data relating to legal entities, including sensitive personal data as defined in the Data Protection Act of 25 September 20201and sensitive data relating to legal entities as defined in the Government and Administration Organisation Act of 21 March 19972.