2 Data Protection sectIOn 18. 19. 20. 21. 22. 23. 24. 25. 26. No. 3 Processing of personal data relating to criminal offences, convictions, etc. Part IV—rIGhts OF a Data suBJect right to access personal data right to data portability right to rectification of personal data right to erasure of personal data right to restriction of processing personal data right to object automated decision-making Derogations Part V—DutIes OF a Data cOntrOLLer anD Data PrOcessOr 27. adherence to data protection principles 28. technical and organizational measures 29. record of personal data processing activities 30. Data protection impact assessment 31. Joint data controllers 32. regulation of the relationship between data controllers and data processors 33. Designation of a data protection officer 34. Duties of a data protection officer Part VI—Data securIty 35. security of personal data 36. notification of personal data breach 37. communication of personal data breach to data subjects Part VII—crOss-BOrDer transFers OF PersOnaL Data 38. cross-border transfer of personal data 39. adequacy of protection of personal data 40. Binding corporate rules, certification mechanisms, etc. Part VIII—reGIstratIOn OF Data cOntrOLLers OF MaJOr IMPOrtance anD Data PrOcessOrs OF MaJOr IMPOrtance 41. registration of data controllers of significant importance and data processors of significant importance 42. suspension or cancellation of registration 43. exemptions