(e) planned trans-border flow of personal information; and (f) a general description allowing a preliminary assessment of the suitability of he information security measures to be implemented by the data controller to ensure the confidentiality, integrity and availability of the information which is to be processed. (3) Subject to subsection (4), a data controller shall give notice each time personal information is received or processed. (4) Changes in the name and address of the data controller shall be notified within one week, and changes to the notification which concern subsection 2(b) to (f) shall be notified within one year of the previous notification, if they are of more than incidental importance. (5) Any processing which departs from that which has been notified in accordance with the provisions of subsection 2(b) to 2(f) shall be recorded and kept for at least three years. (6) The Commission may – (a) prescribe more detailed rules concerning the procedure for submitting notifications; and (b) by notice exempt certain categories of information processing which are unlikely to infringe the legitimate interests of a data subject from the notification requirements referred to in this section. (7) The Commission shall maintain an up-to-date register of the information processing notified to it. Codes of conduct 54 (1) The Commission may, from time to time, issue, approve, amend or revoke a