Content of the notification 27. (1) The notification shall must state, at least,: (a) the date of notification and the act, decree, ordinance or regulatory instrument permitting the automatic processing, if any; (b) the surname, first names and complete address or the name and registered offices of the controller and of his/her representative, if any; (c) the denomination of the automatic processing; (d) the purpose or the set of related purposes of the automatic processing; (e) the categories of personal data being processed and a detailed description of the sensitive data being processed; (f) a description of the category or categories of the data subjects; (g) the safeguards that must be linked to the disclosure of the data to third parties; (h) the manner in which the data subjects are informed, the service providing for the exercise of the right to access and the measures taken to facilitate the exercise of that right; (i) the inter-related processing planned or any other form of linking with other processing; (j) the period of time after the expiration of which the data may no longer be stored, used or disclosed; (k) a general description containing a preliminary assessment of whether the security measures provided for pursuant to Chapter 6, section 24 3 above are adequate; (l) the recourse to a data processor(s), if any; (m) the transfers of data to a third country as planned by the data controller; (2) The Authority may prescribe establish other information which shall must be mentioned in the notification. (3) Where the Authority is of the opinion that the processing or transfer of data by a data controller entails specific risks to the privacy rights of data subjects, he may inspect and assess the security and organizational measures prior to the commencement g of the processing or transfer. Draft Data Protection Bill Version 1.0 37