Data Controller/Administrator 3.3.2 DPCO In this model, NITDA would register DPCOs who will provide training, auditing and compliance services to data controllers and administrators. The criteria for licensing DPCOs are accessible to the public, and licensed DPCOs are listed on NITDA’s website. Data Controllers who process the Personal Data of more than 2,000 Data Subjects in the 12-month period preceding 15th March (or such other date NITDA may stipulate as the deadline for the filing of annual data protection audit reports), are expected to submit a report of their data protection audit to NITDA on an annual basis. 3.4 Appointment of a Data Protection Officer (Art. 4.1(2) NDPR) 3.4.1 A Data Controller is required to appoint a dedicated Data Protection Officer (‘DPO’) within 6 months of commencing business or within 6 months of the issuance of this Framework, where one or more of the following are present: a) the entity is a government organ, Ministry, Department, institution or Agency; b) the core activities of the organisation involve the processing of the Personal Data of over 10,000 (ten thousand) Data Subjects per annum; c) the organisation processes Sensitive Personal Data in the regular course of its business; or 8|Page