No. 3 Data Protection (a) the name and contact details of the data controller or data processor and where applicable, a joint data controller, the representative of the data controller or data processor and the designated data protection officer; (b) the purpose of processing the personal data; (c) a description of the categories of data subjects and the categories of personal data; (d) the categories of recipients to whom the personal data has been, or will be, disclosed; (e) where possible, the envisaged time limits for the erasure of the different categories of the personal data; (f) where possible, a general description of the technical and organizational measures implemented to adhere to this act; and (g) any other information as may be prescribed by the authority. (3) a data controller shall, on demand, make available to the authority the record maintained under subsection (1). 30.__(1) where the processing of personal data is likely to be of high risk to the rights and freedoms of a data subject by virtue of the nature of the data and the scope, context and purpose of the processing, a data controller shall, prior to the processing, carry out a data protection impact assessment. (2) notwithstanding the generality of subsection (1), a data controller shall conduct a data protection impact assessment— (a) where the personal data will be processed using an automated processing system, including profiling; (b) where sensitive personal data or personal data relating to a criminal offence or conviction will be processed on a large scale; (c) where there will be systematic monitoring of a publicly accessible area on a large scale; or (d) in any circumstance prescribed by the authority, by a notice published in the Gazette. (3) a data protection impact assessment shall contain— (a) a systematic description of the envisaged personal data processing; (b) the purpose of the processing of the personal data; (c) where applicable, the legitimate interest pursued by the data controller, data processor or third party, as the case may be; 17 Data protection impact assessment