266 (a) process such information only with the knowledge or authorisation of the data contr:oiler; and (b) treat personal information which comes to their knowledge as confidential and shall not disclose it, unless required by law or in the course of the performance of their duties. security measures regarding information processed by an agent 22, (1) Adata controllel shall ensure that an agent which processes pefsonal information for or on behalf of the data controller establishes and maintains the security measures leferred to in this Act. (Z) The processing of personal information for a data controllel by an agent on behalf of the data controller shall be governed by a written contract between the agent and the clata controller, which requires the agent to establish of the and maintain confidentiality and security measules to ensure the integrity personal information. (3) where the agent is not domiciled or does not have its principal enplace of business in Lesotho, the data controller shall take reasonable steps to personal sule that the agent complies with the laws relating to the protection of infolmation of the tenitory in which the agent is domiciled' Notification of security compromises 23. (1) Where there are reasonable glounds to believe that the personal information of a data subject has been accessed or acquired by an authorised person, the data controller, oI any third party processing personal information under the authority of a data controller', shall notify (a) the Commission; and (b) the data subject, unless the identity of such data subject canuot be established. The notification referred to in subsection (l) shall be made as into soon as reasonably possible after the discovery of the compromise, taking leasonably measul'es any or account the legitimate needs of law enforcement (2)