Personal Data Protection Act, No. 9 of 2022 37 (5) The imposition of a penalty under this section shall not preclude a relevant regulatory or statutory body from taking any other regulatory measures including, but not limited to, the suspension of such controller or processor from carrying on of a business or profession or the cancellation of a licence or authority granted for the carrying on of a business or profession, as may be permitted in terms of any applicable written law or rules for the regulation or supervision of such controller or processor. (6) Where a penalty is imposed under this section on a body of persons, then– (a) if that body of persons is a body corporate, every person who at the time of non-compliance under subsection (1) was a director, and other officer responsible with management and control of that body corporate; (b) if that body of persons is a firm, every partner of that firm; or (c) if that body is not a body corporate, every person who at the time of non-compliance of requirements under subsection (1) was the officer responsible with management and control of that body, shall be liable to pay such penalty, unless he proves that he had no knowledge of the failure to comply with the requirement under subsection (1) or that he exercised all due care and diligence to ensure the compliance therewith. (7) A controller or processor who is aggrieved by the imposition of an administrative penalty under this section, may appeal against such decision to the Court of Appeal within twenty-one working days, from the date of the notice of the imposition of such administrative penalty was communicated to such person. (8) Until rules are made under Article 136 of the Constitution pertaining to appeals under this section, the