Personal Data Protection Act GN. NO. 395B (Contd) permits the contravention shall be liable for the offence. General penalty 63.-(1) Any person who contravenes a provision under this Act commits an offence and where no penalty is specifically provided, shall, upon conviction, be liable to a fine of not less than one hundred thousand shillings but not exceeding five million shillings or imprisonment for a term not exceeding five years or to both. (2) After conviction of a person for any offence under this Act, the court may order for forfeiture of the devices containing the personal data connected with the commission of an offence. Regulations 64.-(1) The Minister may make regulations for giving effect to the provisions of this Act. (2) Notwithstanding the generality of subsection (1), regulations made under this section may prescribe(a) instances which may be exempted from the provisions of this Act; (b) registration procedures under this Act; (c) functions of the data protection officer in relation to personal data protection; (d) functions of the data controller’s representative when collecting and processing personal data on behalf of the data controller; (e) procedures of enforcing rights under this Act; (f) procedures for submission of complaints under this Act; (g) conditions for processing sensitive personal data; (h) appropriate standards relating to security of information to be met by data controllers; (i) various fees to be imposed in respect of implementation of the provisions of this Act; (j) procedures for retention and disposal of personal data held by data controllers; 36