controller, or any other third party processing personal information under the
authority of a data controller, shall notify (a) the commission; and
(b) the data subject, unless the identity of such data subject cannot be
established.
(2) The notification referred to in subsection (1) shall be made as soon as
reasonably possible after the discovery of the compromise, taking into account
the legitimate needs of law enforcement or any measures reasonably necessary
to determine the scope of the compromise and to restore the integrity of the
data controller’s information system.
(3) The data controller shall delay notification to the data subject where the Lesotho
Mounted Police Service, the National Security Service or the Commision
determines that notification will impede a crimial investigation.
(4) The notification to a data subject referred to in subsection (1) shall be in writing
and communicated to the data subject in one of the following ways –
(a) mailed to the data subject’s last known physical or postal address;
(b) sent by e-mail to the data subject’s last known e-mail address;
(c) placed in a prominent position on the website of the party
responsible for notification;
(d) published in the news media; or
(e) as may be directed by the commission.
(5) A person making notification shall ensure that the notification provides
sufficient information to allow the data subject to take protective measures
against potential consequences of the compromise, including, if known to the
data controller, the identity of the unauthorised person who may have accessed
or acquired the personal information.
(6) The Commission may direct a data controller to publicise, in any manner