Data Protection [No. 3 of 2021 115 (3) Processing by a data processor shall be governed by a contract that sets out the subject matter and duration of the processing, the nature and purpose of the processing, the type of personal data and categories of data subjects, the obligations and rights of the controller and any other matter, as prescribed. (4) The Data Protection Commissioner may, for the purposes of this section, issue guidelines specifying further obligations and any other matters regarding data processors. 53. (1) Except as otherwise provided in this Act, a person Nonshall not disclose or otherwise cause any other person to receive disclosure of personal data the content or nature of any personal data that has been collected. (2) Subject to subsection (3), a data controller or data processor who seeks to disclose personal data shall, prior to its disclosure, obtain the consent of the data subject. (3) A data controller or data processor, who seeks to disclose personal data, shall inform the data subject, prior to a disclosure of personal data under this section, of the following details in respect of the data subject’s personal data: (a) when and to whom it will be disclosed; (b) the purpose of its disclosure; (c) the security practices, privacy policies and other policies, if any, that will protect it; and (d) the procedure for recourse in case of any grievance in relation to it. (4) A data controller or data processor shall not disclose, without consent of the data subject, personal data unless it is necessary to prevent— (a) a reasonable threat to national security, defence or public order; or (b) investigate or prosecute a cognisable offence. (5) A person who contravenes a provision of this section commits an offence and is liable on conviction to a fine not exceeding two hundred thousand penalty units or to imprisonment for a term not exceeding two years or to both. 54. (1) Where two or more data controllers jointly determine Joint the purposes and means of processing data, the joint controllers controllers shall enter into an agreement which reflects the respective roles and relationships of the joint controllers’ as they relate to the data subject.