14 Personal Data Protection Act, No. 9 of 2022 (b) where the core activities of processing carried out by the controller or processor consist of the following:– (i) operations which, by virtue of their nature, their scope or their purposes, require regular and systematic monitoring of data subjects on a scale and magnitude as may be prescribed; or (ii) processing of special categories of personal data on a scale and magnitude as may be prescribed; or (iii) processing which results in a risk of harm affecting the rights of the data subjects protected under this Act based on the nature of processing and its impact on data subjects. (2) A Data Protection Officer shall possess relevant academic and professional qualifications as may be prescribed which may include academic background, knowledge and technical skills in matters relating to data protection having competency and capacity to implement strategies and mechanisms to respond to inquiries and incidents related to processing of personal data. (3) Where the controller is a group of entities, such controller may appoint a single Data Protection Officer who is easily accessible by each entity. Where a controller or a processor is a Public Authority, a single Data Protection Officer may be designated for several such public authorities, taking into account their organizational structures. (4) A controller or processor shall publish the contact details of the Data Protection Officer and communicate such details to the Authority.