Personal Data Protection Act, No. 9 of 2022 27 (h) to carry out periodical evaluations into the manner in which and procedures used for any processing activities carried out by a controller or processor, including the data protection management programme; (i) to appoint advisory committees consisting of members whose qualifications, experience and powers and duties shall be as prescibed; (j) to recognize certification and certifying bodies in relation to personal data protection; (k) to enter into agreements with or engage in any activity, either alone or in conjunction with other apex government or regulatory institutions or international agencies or organizations, responsible for data protection outside Sri Lanka for the purposes of this Act; (l) to acquire, take and hold any property movable or immovable which may become vested in it or by virtue of any purchase, grants, gifts or otherwise and to sell, mortgage, lease, grant, convey, device, assign, exchange or dispose of, any such movable or immovable property; (m) to employ such officers and staff including consultants and advisors subject to such terms and conditions of employment to serve as experts as the Authority may consider appropriate for the Authority to discharge its functions;