S30 (b) rules concerning the rights of the data subject by making clear that the right of access doesn’t allow access to personal data linked to a third person without his/her express and written consent; and (c) the rules of notification to the Commission. Other sanctions 52. (1) The Commission may impose a warning to a data controller failing to comply with the obligations of this law, and such warning shall be regarded as a sanction. (2) In case of serious and immediate violation of the individual rights and liberties, the Commission may rule in summary proceedings – (a) the limitation or ceasing of the personal data processing; (b) the temporary or definitive access to some personal data processed; or (c) the temporary or definitive processing not compliant with the provisions of this law. (3) A data controller on whom an enforcement notice has been served, may, within thirty (30) days of receiving the notice apply to a Court having competent jurisdiction for the setting aside or variation of the notice. (4) A complainant, who has been informed of the result of the investigation may, within thirty (30) days of receiving the result appeal to the High Court against the result of the investigation. Offences and penalties 53. A person who – (a) hinders, obstructs or unlawfully influences the Commission or any person acting on behalf of or under the direction of the Commission in the performance of the Commission’s duties and functions under this Act; (b) breaches rules of confidentiality made under this Act; (c) intentionally and unlawfully obstructs a person in the execution of a warrant issued under this Act; (d) fails, without reasonable cause to give a person executing a warrant assistance as the person may reasonably require for the execution of the warrant; or (e) violates, without reasonable cause, its obligations under this Act, subject to the determination of the Commission, commits an offence and shall on conviction be liable to a fine not exceeding one hundred million (E100, 000,000) Emalangeni or five (5) percentage (%) of the annual turnover of the data controller or to imprisonment for a period not exceeding ten (10) years or to both, and if the offender is a juristic person the sentence shall be served by the head of the data controller.