Personal Data Protection Act, No. 9 of 2022 15 (5) The responsibility of the Data Protection Officer shall be to– (a) advise the controller or processor and their employees on data processing requirements provided under this Act or any other written law; (b) ensure on behalf of the controller or processor that the provisions of this Act are complied with; (c) facilitate capacity building of staff involved in data processing operations; (d) provide advice on personal data protection impact assessments; and (e) co-operate and comply with all directives and instructions issued by the Authority on matters relating to data protection. 21. (1) Where processing is to be carried out by a processor on behalf of a controller, the controller shall– (a) use only processors who ensure the provision of appropriate technical and organizational measures to give effect to the provisions of this Act and ensure the protection of rights of the data subjects under this Act; and (b) ensure that such processor is bound by a contract or provisions of any written law which sets out the subject-matter and duration of the processing, the nature and purpose of the processing, the type of personal data and categories of the data subjects and the obligations of the controller. (2) Where two or more controllers jointly determine the purposes and means of processing, such controllers shall be referred to as “joint controllers” who shall be jointly responsible for discharging the obligations stipulated under this Act. Additional obligations of a controller