267 necessary to detelmine the scope of the complomise and to restore the integrity of the data controllel's information system. (3) The data controller shali delay notification to the data subject where the Lesotho Mounted Police Service, the National Security Selvice ol the Commission determines that notification will impede a criminal investigation. (4) sha11 The notification to a data subject'eferred to in subsection (1) be in writing and communicated to the data subject in one of the following ways (a) mailed to the data subject's last known physical or postal address; (b) sent by e-mail to the data subject's last known e-maii ad- dless; (c) placed in a prominent position on the website of the party responsible for notification; (d) published in the news media; (e) as rnay be directed or' by the Commission. (5) A person making notification shall ensure that the notification ptovides sufficient information to allow the data subject to take plotective measures against potential consequences of the compromise, including, if known to the data controller, the identity of the unauthorised person who may have accessed or acquired the pelsonal information. 6) The Commission may direct adatacontroller to publicise, in any manner specified, the fact of any compromise to the integrity or confidentiality of personal information, where the commission has reasonable grounds to believe that the publicity would protecr a data subject who may be affected by the compromise. Quality of information 24. (1) The party responsible for collecting and plocessing of pelsonal information shall take reasonably practicable steps to ensure that the personal