S28 (b) by notice exempt certain categories of information processing which are unlikely to infringe the legitimate interests of a data subject from the notification requirements referred to in this section. (7) The Commission shall maintain an up-to-date register of the information processing notified to it. (8) A data controller shall process personal information only upon notification to the Commission. Codes of conduct 47. (1) The Commission may, from time to time issue, approve, amend or revoke a code of conduct. (2) A code of conduct shall incorporate measures that give effect to all information protection principles, given the particular features of the sector or sectors of society in which the relevant data controller is operating. (3) A code of conduct may apply in relation to any one or more of the following – (a) specified information or class of information; or (b) specified body or class of bodies; (4) The Commission shall ascertain, among other things whether the draft code of conduct submitted to it is in accordance with this law. If it sees fit, the Commission shall seek the views of data subjects or their representatives. PART VIII MISCELLANEOUS Appointment of Data Protection Officers 48. (1) The head of a data controller may, subject to this Act, by order designate one or more officers or employees to be Data Protection Officers of that controller to exercise, discharge or perform any of the power, duties or functions of the head of the data controller under this Act. (2) A data protection officer’s responsibilities shall include, without limitation – (a) promoting compliance by the controller, with controller’s obligations under this Act; (b) dealing with requests made to the controller pursuant to the controller’s obligations under this Act; (c) cooperating with the Commission in relation to investigations or proceedings conducted in relation to the controller; and (d) pursuing legal appeals with relevant judicial authorities.