32 Personal Data Protection Act, No. 9 of 2022 (2) The Authority may, after giving an opportunity to the controller or processor to be heard at any inquiry under subsection (1), issue a directive to the controller or processor requiring such controller or processor within such time as may be prescribed– (a) to cease and refrain from engaging in, the act, omission or course of conduct related to processing; or (b) to perform such acts as in the opinion of the Authority are necessary to rectify the situation; or (c) to make a payment of such sum of money as compensation as determined by the Authority to an aggrieved person who has suffered harm, loss or damage as a result of any contravention by a controller or processor under subsection (1). (3) Every directive issued to such controller or processor under this section shall be in writing and be communicated to such controller or processor to whom it is directed by registered post, electronic communication or other similar means determined by the Authority, and such directive shall be binding on such controller or processor, who shall comply with such directive from the date of such communication. PART VI DIRECTOR-GENERAL AND THE STAFF OF THE AUTHORITY Appointment of the DirectorGeneral 36. (1) The Board shall appoint a Director-General of the Authority who have achieved eminence and the proven professional expertise in providing leadership to public sector or private sector. (2) The Director-General shall be the chief executive officer of the Authority and the conditions of employment including remuneration of the Director-General shall be determined by the Board by way of rules.