(3) 60. A copy of the report received under sub-section (2) shall be laid, as soon as may be after it is received, before each House of the Parliament. Powers and Functions of the Authority.— (1) It shall be the duty of the Authority to protect the interests of data principals, prevent any misuse of personal data, ensure compliance with the provisions of this Act, and promote awareness of data protection. (2) Without prejudice to the generality of the foregoing and other functions set out under this Act, the functions of the Authority shall include— (a) (b) (c) (d) (e) (f) (g) (h) (i) (j) (k) (l) (m) monitoring and enforcing application of the provisions of this Act; specifying reasonable purposes for which personal data may be processed under section 17 of this Act; specifying residuary categories of sensitive personal data under section 22 of this Act; taking prompt and appropriate action in response to a data security breach in accordance with the provisions of this Act; specifying the circumstances where a data protection impact assessment may be required to be undertaken in accordance with section 33 of this Act; maintaining a database on its website containing names of significant data fiduciaries along with a rating in the form of a data trust score indicating compliance with the obligations of this Act by such fiduciaries; specifying the criteria for assigning a rating in the form of a data trust score by a data auditor having regard to the factors mentioned in sub-section (2) of section 35; examination of any data audit reports submitted under section 35 of this Act and taking any action pursuant thereto in accordance with the provisions of this Act; issuance of a certificate of registration to data auditors and renewal, modification, withdrawal, suspension or cancellation thereof and maintaining a database on its website of such registered data auditors and specifying the requisite qualifications, code of conduct, practical training and functions to be performed by such data auditors; categorisation and issuance of certificate of registration to significant data fiduciaries and renewal, modification, withdrawal, suspension or cancellation thereof under section 38; monitoring cross-border transfer of personal data undersection 41 of this Act; issuing codes of practice in accordance with section 61 of this Act and publishing such codes on its website; promoting public awareness and understanding of the risks, rules, safeguards and rights in respect of protection of personal data, including issuance of any public statement setting out trends in, or specific instances of, contravention of the 33