➢ posted at conspicuous parts of the Data Controller’s business premises; ➢ by reading or providing a copy to the Data Subject; or ➢ publication in any public media. Where the privacy policy is not given or read to the Data Subject, the request for consent should explicitly refer the Data Subject to where the privacy policy can be accessed; v. design and maintain systems to be data protection compliant: Data Controllers must show that their systems are built with data protection in mind, as provided in Article 2.6. Data Controllers are, therefore, expected to ensure continuous improvement of their information security architecture to prevent possible data breaches. vi. undertake continuous capacity building for members of staff, contractors, vendors, and relevant third parties; vii. develop and circulate an internal data protection strategy or policy to help members of staff and vendors to understand the organisation’s direction in connection with the collection and processing of Personal Data and outline the steps they are to take to ensure the organisation’s direction is achieved and maintained; viii. conduct a Data Protection Impact Assessment (‘DPIA’) in accordance with the provisions of the NDPR (A DPIA is a process to identify, evaluate and minimise possible data protection risks in an existing or new business or organisational activity. Where the organisation intends to embark on a project that would involve the intense use of personal data, a DPIA should be conducted to identify possible areas where breaches may occur and devise a means of addressing such risks. Organisations are expected to conduct a DPIA on their processes, services and technology periodically to ensure continuous compliance); 6|Page