38 Personal Data Protection Act, No. 9 of 2022 rules made under that Article pertaining to an application by way of revision to the Court of Appeal, shall apply in respect of every appeal made under subsection (7) of this section. (9) Any controller or processor who prefer an appeal to the Court of Appeal under subsection (7), shall, deposit in cash as a security such sum of money equal to the penalty imposed under subsections (1) or (2) before the registrar of the Court of Appeal. (10) Where an appeal is preferred under subsection (7), the burden of proof shall be on the controller or the processor as the case may be, to prove that he has acted in compliance with the provisions of this Act. Matters to consider when imposing a Penalty 39. In making a determination to impose an administrative penalty, including the amount as provided in subsection (1) of section 38, the Authority shall have regard to the following matters:– (a) the nature, gravity and duration of the contravention taking into account the nature, scope or purpose of the processing concerned as well as the number of data subjects affected and the level of damage suffered by them; (b) any action taken by the controller or processor to mitigate the damage suffered by data subjects; (c) the effectiveness of the data protection management programme required from the controller under section 12; (d) the degree of co-operation with the Authority, in order to remedy the contravention and mitigate the possible adverse effects of such contravention;