104 No. 3 of 2021] Data Protection (2) Where the offence is committed by a natural person, that person shall be liable, on conviction to a fine not exceeding one million penalty units or to imprisonment for a term not exceeding five years, or to both. PART V REGULATION OF DATA CONTROLLERS, DATA PROCESSORS AND DATA AUDITORS Prohibition from controlling or processing personal data without registration 19. (1) A person shall not control or process personal data without registering as a data controller or a data processor under this Act. Application for registration as data processor or data controller 20. (1) A person who intends to process personal data shall apply to the Data Protection Commissioner for registration as a data controller or data processor in a prescribed manner and form on payment of a prescribed fee. (2) A person who contravenes subsection (1) commits an offence and is liable, on conviction to a fine not exceeding five hundred thousand penalty units or to imprisonment for a term not exceeding five years or both. (2) The Data Protection Commissioner may, within fourteen days of receipt of an application under subsection (1), grant or reject the application. (3) The Data Protection Commissioner shall, where it rejects an application under subsection (2), inform the applicant, in writing and give reasons for the decision. Registration of data controller and data processor 21. (1) The Data Protection Commissioner shall, within fourteen days of the approval of an application under section 20, issue the applicant with a certificate of registration, if the applicant meets the prescribed requirements. (2) A registered data controller or data processor shall display the certificate of registration issued under this Act in a conspicuous place at the registered data controller’s or data processor’s principal place of business and a certified copy of the certificate of registration at every subsidiary premises where the registered data controller or data processor carries on business. Renewal of certificate of registration 22. (1) A registered data controller or data processor may three months before the expiration of the validity of the certificate, apply to the Authority for renewal of a certificate of registration in a prescribed manner and form on payment of a prescribed fee.