Act Data Protection And Privacy Act 2019 38. Offences by corporations. (1) Where an offence under sections 31 and 32 is committed by a corporation, the corporation and every officer of the corporation who knowingly and willfully authorises or permits the contravention is liable to the offence. (2) A court which convicts a person under subsection (1) may, in addition to the punishment order the corporation, pay a fine not exceeding two percent of the corporation's annual gross turnover. (3) A court shall take into consideration the gravity of the offence under subsection (1) and its impact in determining the fine to impose under subsection (2). 39. Regulations. The Minister may, after consultation with the Authority by statutory instrument make regulations for(a) any matter which is required to be prescribed; (b) any administrative or procedural matter which is necessary to give effect to this Act; (c) the retention period of personal data; or (d) any matter which is necessary and expedient to give effect to this Act. 40. Power of the Minister to amend Schedule. The Minister may, with the approval of Cabinet, by statutory instrument, amend the Schedule.