21.
(1) An data processor or anyone processing personal information on behalf of a
data controller shall (a) process such information only with the knowledge or authorisation
of the data controller; and
(b) treat personal information which comes to their knowledge as
confdential and shall not disclose it, unless required by law or in the
course of the performance of their duties.
Security measures regarding information processed by a data processor
22.
(1) A data controller shall ensure that an data processor which processes personal
information for or on behalf of the data controller establishes and maintains the
security measures referred to in the Act.
(2) The processing of personal information for a data controller by an data
processor on behalf of the data controller shall be governed by by a written
contract between the data processor and the data controller, which requires the
data processor to establish and maintain confidentiality and security measures
to ensure the integrity of the personal information.
(3) Where the data processor is not domiciled or does not have its principle place of
business in Lesotho, the data controller shall take reasonable steps to ensure
that the data processor complies with the laws relating to the protection of
personal information of the territory in which the data processor is domiciled.
Notification of security compromises
23.
(1) Where there are reasonable grounds to believe that the personal information of
a data subject has been accessed or acquired by an authorised person, the data