6 Personal Data Protection Act, No. 9 of 2022 including encryption, pseudonymisation, anonymisation or access controls or such other measures as may be prescribed so as to prevent the – (a) unauthorized or unlawful processing of personal data; or (b) loss, destruction or damage of personal data. Obligation to process personal data in a transparent manner 11. A controller shall, provide data subjects— (a) the information referred to in Schedule V; and (b) the information regarding any decision taken pursuant to a request made under PART II of this Act, in writing or by electronic means and in a concise, transparent, intelligible and easily accessible form. Accountability in the processing of personal data 12. (1) It shall be the duty of every controller to implement internal controls and procedures, (hereinafter referred to as the “Data Protection Management Programme”) that— (a) establishes and maintains duly catalogued records to demonstrate the manner in which the implementation of the data protection obligations referred to in sections 5, 6, 7, 8, 9, 10 and 11 are carried out by the controller; (b) is designed on the basis of structure, scale, volume and sensitivity of processing activities of the controller; (c) provides for appropriate safeguards based on data protection impact assessments specified in section 24; (d) is integrated into the governance structure of the controller;