Data Protection [No. 3 of 2021 105 (2) The Data Protection Commissioner shall, within thirty days of receiving an application for the renewal of a certificate of registration, approve or reject the application and give reasons where it rejects the application for renewal of the certificate. (3) A holder of a certificate of registration who submits an application for the renewal of a certificate of registration in accordance with subsection (1), shall continue to operate the business or activity until a decision is made by the Data Protection Commissioner on the application. 23. A registered data controller or data processor under this Act shall notify the Data Protection Commissioner of any change in the particulars relating to the registration within seven days of the change. Change in details of data controller or data processor 24. (1) Subject to other provisions of this Act, the Data Protection Commissioner may suspend or cancel the registration of a data controller or data processor if the registered data controller or data processor— Suspension or cancellation of registration (a) obtained the registration on the basis of fraud, misrepresentation or concealment of a material fact; (b) has ceased to carry on business in the data processing or controlling industry for a prescribed period; (c) fails to comply with any term or condition of the certificate of registration; or (d) operates the registered business activity in contravention of this Act or any other relevant written law. (2) The Data Protection Commissioner shall, not less than thirty days before suspending or cancelling registration of a data controller or data processor in accordance with subsection (1), notify the registered data controller or data processor of the intention to suspend or cancel the registration giving reasons for its decision and requesting the registered data controller or data processor to show cause, within a period as the Data Protection Commissioner shall specify in the notice, why the registration of the data controller or data processor shall not be suspended or cancelled. (3) Where the Data Protection Commissioner is not satisfied with the reasons advanced by the data controller or data processor under subsection (2), the Data Protection Commissioner shall proceed to suspend or cancel, the registration stating the reasons for the suspension or cancellation.