(b) (c) 34. (4) Upon completion of the data protection impact assessment, the data protection officer shall review the assessment prepared and shall submit the same to the Authorityin such manner as may be specified. (5) On receipt of the assessment, if the Authority has reason to believe that the processing is likely to cause harm to the data principals, the Authority may direct the data fiduciary to cease such processingor direct that such processing shall be subject to such conditions as may be issued by the Authority. Record-Keeping. — (1) The data fiduciary shall maintain accurate and up-to-date records of the following— (a) (b) (c) (d) 35. assessment of the potential harm that may be caused to the data principals whose personal data is proposed to be processed; and measures for managing, minimising, mitigating or removing such risk of harm. important operations in the data life-cycle including collection, transfers, and erasure of personal data to demonstrate compliance as required under section 11; periodic review of security safeguards under section 31; dataprotection impact assessments under section 33; and any other aspect of processing as may be specified by the Authority. (2) The records in sub-section (1) shall be maintained in such form as specified by the Authority. (3) Notwithstanding anything contained in this Act, this section shall apply to the Central or State Government, departments of the Central and State Government, and any agency instrumentality or authority which is “the State” under Article 12 of the Constitution. Data Audits. — (1) The data fiduciary shall have its policies and the conduct of its processing of personal data audited annually by an independent data auditor under this Act. (2) The data auditor will evaluate the compliance of the data fiduciary with the provisions of this Act, including— (a) (b) (c) (d) (e) (f) clarity and effectiveness of notices under section 8; effectiveness of measures adopted under section 29; transparency in relation to processing activities under section 30; security safeguards adopted pursuant to section 31; instances of personal data breach and response of the data fiduciary, including the promptness of notification to the Authority under section 32; and any other matter as may be specified. 20