110 No. 3 of 2021] Data Protection (4) The Data Protection Commissioner shall, in making its final determination on the suspension or cancellation of the licence consider submissions made by the licensee under subsection(2). (5 The Data Protection Commissioner may suspend or cancel a licence if the holder after being notified under subsection (2) fails to show cause or does not take remedial measures, to the satisfaction of the Data Protection Commissioner within the time specified in that subsection. (6) The Data Protection Commissioner shall, where it suspends or cancels a licence under this section, publish the suspension or revocation in the Register. Renewal of licence 37. (1) A licensee may, not less than three months before the expiry of a licence, apply for a renewal of the licence in the prescribed manner and form on payment of a prescribed fee. (2) The Data Protection Commissioner shall, where a licensee makes an application under subsection (1), renew the licence if the licensee — (a) fulfils the eligibility requirements as prescribed under this Act; (b) at the time of the renewal, the licensee is compliant with the terms and conditions of the licence, the Guidelines issued by the Data Protection Commissioner or any other relevant law. (3) Where the Data Protection Commissioner rejects an application for renewal of a licence, the Data Protection Commissioner shall inform the licensee and give reasons for the rejection. Functions of data auditor 38. The functions of a data auditor are to— (a) promote adherence to principles of data protection by controllers and processors of data; (b) ensure that data controllers and data processors implement adequate policies and procedures to regulate the processing of personal data; (c) enhance public and stakeholder awareness of data protection principles and rights; and (d) check that data controllers implement adequate safeguards to prevent data leaks and data breaches from data controllers and data processors.