Do you know that personal data which relates to the physical, mental health or mental condition, and also personal data in respect of which the data controller is an educational institution and which relates to a pupil at the institution shall not be disclosed except where the disclosure is required by law? Section 62 of Data Protection Act, 2012 (Act 843).