4 Data Protection No. 3 measurement, facial image, blood type, fingerprint, retinal scan, voice recognition and deoxyribonucleic acid analysis; “certification mechanism” means certification of personal data protection policies and procedures in accordance with internationally recognized standards, by an official authority or professional third-party entity; “child” means a person below the age of eighteen years; “consent” means specific, informed and unambiguous agreement or approval by a natural person, given freely, in writing, orally or by any affirmative action, to a data controller or data processor to process personal data relating to that person or to another natural person on whose behalf the person has the authority to provide the consent; “data controller” means a natural or legal person who, alone or jointly with another natural or legal person, determines the purpose and means of processing personal data; “data controller of significant importance” means a data controller who__ (a) is domiciled, ordinarily resident, or ordinarily operates in Malawi and processes or intends to process personal data of more than ten thousand data subjects who are resident in Malawi; or (b) processes or intends to process personal data of significance to the economy, society or security of Malawi; “data processor” means a natural or legal person who processes personal data on behalf of a data controller; “data processor of significant importance” means a data processor who__ (a) is domiciled, ordinarily resident, or ordinarily operates in Malawi and processes or intends to process personal data of more than ten thousand data subjects who are resident in Malawi; or (b) processes or intends to process personal data of significance to the economy, society or security of Malawi; “data protection officer” means a person designated as such pursuant to section 33; “data subject” means a natural person to whom particular personal data relates;