114 No. 3 of 2021] Data Protection Appointment of data protection officer 48. (1) Subject to subsection (2), a data controller and data processor shall appoint a data protection officer. Notification of security breach 49. (1) A data controller shall notify the Data Protection Commissioner within twenty-four hours of any security breach affecting personal data processed. (2) A data protection officer shall be appointed in accordance with the guidelines issued by the Data Protection Commissioner. (2) A data processor shall notify the data controller, as soon as practicable of any security breach affecting personal data processed on behalf of the data controller. (3) A data controller or data processor shall notify the data subject, as soon as practicable of any security breach affecting personal data processed. Accountability 50. A data controller and data processor shall— (a) take necessary measures to comply with the principles and obligations specified in this Act; and (b) have the necessary internal mechanisms in place for demonstrating such compliance to both data subjects and to the Data Protection Commissioner. Data Retention 51. (1) Subject to the provisions of this Act, a data controller and data processor shall keep personal information for as long as that personal information is used for the specific purpose for which the personal information was collected and for as long as the personal information is relevant for that purpose and for a period of at least one year thereafter or other period that may be prescribed. (2) A data controller and a data processor shall keep a record of the process and a record of the purpose for which the personal information was collected and third parties to whom and when the personal information was disclosed. Duties of data processor 52. (1) A data processor shall not engage another data processor without prior specific or general written authorisation of the data controller. (2) A data processor shall, where a data controller is granted general authorisation to engage another data processor, inform the data controller of any intended changes concerning the addition or replacement of other data processors, thereby giving the data controller the opportunity to object to those changes.