Act Data Protection And Privacy Act 2019 (2) The appeal shall be made within thirty days from the date of notice of the decision. (3) A copy of the appeal shall be provided to the Authority. PART VIII-OFFENCES 35. Unlawful obtaining or disclosing of personal data. (1) A person shall not unlawfully obtain, disclose or procure the disclosure to another person of personal data held or processed by a data collector, data controller or data processor. (2) A person who contravenes this section commits an offence and is liable on conviction to a fine not exceeding two hundred and forty currency points or imprisonment for ten years or both. 36. Unlawful destruction, deletion, concealment or alteration of personal data. (1) A person shall not unlawfully destroy, delete, mislead, conceal or alter personal data. (2) A person who contravenes this section commits an offence and is liable on conviction to a fine not less than two hundred and forty currency points or imprisonment not exceeding ten years or both. 37. Sale of personal data. (1) A person shall not sell or offer for sale personal data of any person . (2) A person who contravenes subsection (1) commits an offence and is liable on conviction to a fine not exceeding two hundred and forty five currency points or imprisonment not exceeding ten years or both.