36. (3) The Authority shall specify the form, manner and procedure for conducting audits under this section including any civil penalties on data auditors for negligence. (4) The Authority shall register persons with expertise in the area of information technology, computer systems, data science, data protection or privacy, with such qualifications, experience and eligibility having regard to factors such as independence, integrity and ability, as it may specify, as data auditors under this Act. (5) A data auditor may assign a rating in the form of a data trust score to the data fiduciary pursuant to a data audit conducted under this section. (6) The Authority shall specify the criteria for assigning a rating in the form of a data trust score having regard to the factors mentioned in sub-section (2). (7) Notwithstanding sub-section (1) where the Authority is of the view that the data fiduciary is processing personal data in a manner that is likely to cause harm to a data principal, the Authority may order the data fiduciary to conduct an audit and shall appoint a data auditor for that purpose. Data Protection Officer. — (1) The data fiduciary shall appoint a data protection officer for carrying out the following functions— (a) (b) (c) (d) (e) (f) (g) (2) providing information and advice to the data fiduciary on matters relating to fulfilling its obligations under this Act; monitoring personal data processing activities of the data fiduciary to ensure that such processing does not violate the provisions of this Act; providing advice to the data fiduciary where required on the manner in which data protection impact assessments must be carried out, and carry out the review of such assessment as under sub-section (4) of section 33; providing advice to the data fiduciary, where required on the manner in which internal mechanisms may be developed in order to satisfy the principles set out under section 29; providing assistance to and cooperating with the Authority on matters of compliance of the data fiduciary with provisions under this Act; act as the point of contact for the data principal for the purpose of raising grievances to the data fiduciary pursuant to section 39 of this Act; and maintaining an inventory of all records maintained by the data fiduciary pursuant to section 34. Nothing shall prevent the data fiduciary from assigning any other function to the data protection officer, which it may consider necessary, in addition to the functions provided in sub-section (1) above. 21