S15 Security measures for information processed by data processor 16. (1) A data controller shall ensure that a data processor which processes personal information for or on behalf of the data controller establishes and maintains the security measures referred to in this Act. (2) The processing of personal information for a data controller by a data processor on behalf of the data controller shall be governed by a written contract between the data processor and the data controller, which requires the data processor to establish and maintain confidentiality and security measures to ensure the integrity of the personal information. (3) Where the data processor is not domiciled or does not have its principal place of business in Eswatini, the data controller shall take reasonable steps to ensure that the data processor complies with the laws relating to the protection of personal information of the territory in which the data processor is domiciled. Notification of security compromise 17. (1) Where there are reasonable grounds to believe that the personal information of a data subject has been accessed or acquired by an unauthorised person, the data controller, or any other third party processing personal information under the authority of a data controller, shall notify (a) the Commission; and (b) the data subject, unless the identity of such data subject cannot be established. (2) The notification referred to in subsection (1) shall be made as soon as reasonably possible after the discovery of the compromise, taking into account the legitimate needs of law enforcement or any measures reasonably necessary to determine the scope of the compromise and to restore the integrity of the information system of the data controller. (3) The data controller shall delay notification to the data subject where the Police or the Commission determines that notification will impede a criminal investigation. (4) The notification to a data subject referred to in subsection (1) shall be in writing and communicated to the data subject in one of the following ways – (a) mailed to the last known physical or postal address of the data subject; (b) sent by e-mail to the last known e-mail address data subject; (c) placed in a prominent position on the website of the party responsible for notification; (d) published in the news media; or (e) as may be directed by the Commission. (5) A person making notification shall ensure that the notification provides sufficient information to allow the data subject to take protective measures against potential consequences of the compromise, including, if known to the data controller, the identity of the unauthorised person who may have accessed or acquired the personal information.