(f) (g) (h) (5) 75. transparency and accountability measures implemented by the data fiduciary or data processor including adherence to any relevant code of practice relating to security safeguards; action taken by the data fiduciary or data processor to mitigate the harm suffered by data principals; and any other aggravating or mitigating factors relevant to the circumstances of the case, such as, the amount of disproportionate gain or unfair advantage, wherever quantifiable, made as a result of the default. Any person aggrieved by an order under this section by the Adjudicating Officer may prefer an appeal to the Appellate Tribunal. Compensation.— (1) Any data principal who has suffered harm as a result of any violation of any provision under this Act, or rules prescribed or regulations specified hereunder, by a data fiduciary or a data processor, shall have the right to seek compensation from the data fiduciary or the data processor, as the case may be. Explanation.- For the removal of doubts, it is hereby clarified that a data processor shall be liable only where it has acted outside or contrary to the instructions of the data fiduciary pursuant to section37, or where the data processor is found to have acted in a negligent manner, or where the data processor has not incorporated adequate security safeguards under section 31, or where it has violated any provisions of this Act expressly applicable to it. (2) The data principal may seek compensation under this section pursuant to a complaint instituted in such form and manner as may be prescribed before an Adjudicating Officer. (3) Where there are one or more data principals or any identifiable class of data principals who have suffered harm as a result of any violation by the same data fiduciary or data processor, one complaint may be instituted on behalf of all such principals seeking compensation for the harm suffered. (4) While deciding whether to award compensation and the amount of compensation under this section, the Adjudicating Officer shall have due regard to the following factors, namely— (a) (b) (c) (d) (e) nature, duration and extent of violation of the provisions of the Act, rules prescribed, or regulations specified thereunder; nature and extent of harm suffered by the data principal; intentional or negligent character of the violation; transparency and accountability measures implemented by the data fiduciary or the data processor, as the case may be, including adherence to any relevant code of practice relating to security safeguards; action taken by the data fiduciary or the data processor, as the case may be, to mitigate the damage suffered by the data principal; 44