18 Data Protection No. 3 (d) an assessment of the necessity and proportionality of the processing of the personal data, in relation to the purpose of processing the data; (e) an assessment of the risk to the rights and freedoms of the data subject; (f) the measures envisaged to be put in place to address the risk, taking into account the rights, and legitimate interests of the data subject and any other natural person concerned; and (g) any other information as may be prescribed by the authority. (4) a data controller shall submit the data impact assessment report to the authority, prior to the processing of the personal data. (5) a data controller shall, where there is a change in the risk represented in the data protection impact assessment report, carry out a review of the risk to assess if the processing of the personal data is being done in accordance with the data protection impact assessment. (6) the authority may by notice published in the Gazette, prescribe guidelines for carrying out a data protection impact assessment. Joint data controllers (7) the Minister may, by an order published in the Gazette, exempt a data controller or data processor from the obligation prescribed under subsection (1). 31.__(1) where two or more data controllers jointly determine the purpose and means of processing personal data of a data subject, the data controllers shall be joint data controllers. (2) Joint data controllers shall enter into a written agreement that clearly stipulates the role of each data controller and assign the duties under this Part to the joint data controllers. (3) Joint data controllers shall provide a summary of the agreement entered into under subsection (2) to the data subject whose personal data is to be processed under the agreement. regulation of the relationship between data controllers and data processors (4) Joint data controllers shall be jointly and severally liable to the data subject whose personal data is processed under the agreement. 32.__(1) a data controller and a data processor who intend to process personal data of a data subject shall enter into a written contract that sets out— (a) the subject matter and duration of the processing of the data;