1. The Agency may process personal data only for the following purposes:
(a)
where necessary for the performance of its tasks related to the operational management of large-scale IT systems entrusted to it under Union law;
(b)
where necessary for its administrative tasks.
2. Where the Agency processes personal data for the purpose referred to in point (a) of paragraph 1 of this Article, Regulation (EU) 2018/1725 shall apply without prejudice to the specific provisions concerning data protection and data security of the Union legal acts governing the development, establishment, operation and use of the systems.