Personal Data Protection Act, No. 9 of 2022 13 (e) refusal to review a decision based solely on automated processing under section 18(1) was lawful. (3) After concluding the necessary investigations, the Authority shall determine, within such period as may be prescribed, whether the appeal is allowed or disallowed and the Authority shall inform the data subject and the controller the determination with reasons thereof. (4) Where the Authority allows the appeal under subsection (2), the controller shall take steps to give effect to the decision of the Authority, within such period as may be determined by the Authority, and the controller shall inform the data subject and the Authority, the steps taken to give effect to its decision. (5) Any data subject or controller aggrieved by the decision of the Authority, may prefer an appeal to the Court of Appeal not later than thirty days from the date of such decision. PART III CONTROLLERS AND PROCESSORS 20. (1) Every controller and processor shall designate or appoint a Data Protection Officer, to ensure compliance with the provisions of this Act, in the following circumstances:– (a) where the processing is carried out by a ministry, government department or public corporation, except for judiciary acting in their judicial capacity; or Designation or appointment of the Data Protection Officer