34 Staff of the Authority Personal Data Protection Act, No. 9 of 2022 37. (1) Nothwithstanding anything to the contrary in any other written law, the Authority may create cadre positions and employ officers and employees as it considers necessary for the efficient discharge of its functions and may fix their salaries and wages or other remuneration, benefits and pensions of such officers and employees for the purposes of carrying out its duties and functions under the provisions of this Act. (2) The Authority shall promote and sponsor the training of technical personnel on the subjects of information security, data science, data analytics, information technology, finance, law and other related subjects and for this purpose, the Authority shall be authorised to defray the costs of study, in Sri Lanka or abroad of the officers and employees of the Authority who are of proven merit as determined by the Authority. (3) The Authority shall prepare a code of conduct which shall be applicable to the officers and employees of the Authority. (4) The Authority may revise such code of conduct by modifying, rescinding or amending from time to time. (5) The Authority shall not appoint any person to the staff of the Authority where such person– (a) has been previously found guilty of serious misconduct by a court or tribunal or has been subject to a disciplinary action by a regulatory body; (b) has been previously dismissed from office; or (c) has committed a breach of the provisions of this Act or regulations, rules or directives made thereunder.