Personal Data Protection Act, No. 9 of 2022 17 (5) For the purposes of this section “personnel” means any employee, consultant, agent, affiliate or any person who is contracted by the processor to process personal data. 23. (1) In the event of a personal data breach, a controller shall notify the Authority, regarding such personal data breach in such form, manner and within such period of time as may be determined by rules made under this Act. Personal Data breach notifications (2) The Authority shall provide for– (a) the circumstances where the Authority shall be notified of such data breach; (b) the circumstances where the affected data subject shall be notified; and (c) the form, and manner of making such notification, and information which shall be provided in such notification relating to the data breach, by way of rules made under this Act. 24. (1) Where a Controller intends to carry out any processing which involves– (a) a systematic and extensive evaluation of personal data or special categories of personal data including profiling; (b) a systematic monitoring of publicly accessible areas or telecommunication networks; or (c) a processing activity as may be determined by way of rules taking into consideration the scope and associated risks of that processing, Personal data protection impact assessments