S4 52. Other Sanctions 53. Offences and penalties 54. Regulations 55. Transitional Arrangements PART I PRELIMINARY Citation and Commencement 1. (1) This Act may be cited as the Data Protection Act, 2022. (2) This Act shall come into operation on the date of publication in the Gazette. Interpretation 2. In this Act, unless the context otherwise requires – “authorization” means a licence or individual right of use that a person may hold or be granted under any law administered by the Commission; “biometric” means a technique of personal identification that is based on physical characteristics including fingerprinting, DNA analysis, retinal scanning and voice recognition; “child” has the same meaning ascribed in the Children’s Protection and Welfare Act, 2012; “code of conduct” means codes of conduct approved by the Commission and includes industry codes of conduct applicable to a data controller and approved by the Commission; “Commission” means the Eswatini Communications Commission, established under the Eswatini Communications Commission Act, 2013; “Constitution” means the Constitution of the Kingdom of Eswatini, 2005; “data” refers to all representations of information notwithstanding format or medium; “data controller” means a public or private body which or any other person designated by law, who alone or together with others, determines the purpose of and means for processing personal information, regardless of whether or not such data is processed by that party or by a data processor on its behalf, where the purpose and means of processing are determined by law; “data processor” refers to a natural or legal person, or public body which processes personal information for and on behalf of a data controller and under the instructions of a data controller, and excludes persons who are authorised to process data under the direct authority of a data controller; “Data Protection Officer; means a person appointed by a data controller charged with ensuring compliance with this Act;