S27 (ii) appropriate measures have been taken to protect the data subject’s legitimate interests such as requiring a data controller to provide a data subject with sufficient information about the decision to enable him to make representations and allowing a data subject to make representations about a decision referred to in subsection (1); or (b) is governed by a law or code in which appropriate measures are specified for protecting the legitimate interests of data subjects. (c) is governed by a body of science or scientific proofs or facts with the same measures as in (b). Notifications 46. (1) A data controller shall notify the Commission of the processing of personal information to which the Act applies. (2) The notification contemplated in section (1) shall contain the following particulars – (a) the name and address of the data controller; (b) the purpose of the processing; (c) a description of the categories of data subjects and of the information or categories of information relating thereto; (d) the recipients or categories of recipients to whom the personal information may be supplied; (e) planned trans-border flow of personal information; and (f) a general description allowing a preliminary assessment of the suitability of the information security measures to be implemented by the data controller to ensure the confidentiality, integrity and availability of the information which is to be processed. (3) Subject to subsection (4), a data controller shall give notice each time personal information is received or processed. (4) Changes in the name and address of the data controller shall be notified within one (1) week, and changes to the notification which concern subsection (2)(b) to (f) shall be notified within one (1) year of the previous notification, if they are of more than incidental importance. (5) Any processing which departs from that which has been notified in accordance with the provisions of subsection (2)(b) to (2)(f) shall be recorded and kept for at least three (3) years. (6) The Commission may – (a) prescribe more detailed rules concerning the procedure for submitting notifications; and