characteristics including fingerprinting, DNA analysis, retinal scanning voice recognition; “child” means a natural person under the age of 18 years; “code of conduct” refers to the data-use charters drafted by the data controller in order to institute the rightful use of IT resources, the Internet, and electronic communications of the structure concerned, and which have been approved by the Commissioner and includes industry codes of conduct applicable to the data controller and approved by the Commissioner. “Commission” means the Data Protection Commission established under this law; “Constitution” means the Constitution of Lesotho of 1993 as amended; “data” refers to all representations of information notwithstanding format or medium. data controller” means a public or private body or any other person which or who, alone or together with others, determines the purpose of and means for processing personal information, regardless of whether or not such data is processed by that party or by an data processor on its behalf, where the purpose and means of processing are determined by or by virtue of an act, decree or ordinance, the controller is the natural person, legal person or public body has been designated as such by or by virtue of that act, decree or ordinance; “data processor” refers to a natural person, legal person, or public body which processes personal information for and on behalf of the controller and under the data controller’s instruction, except for the persons who, under the direct authority of the controller, are authorised to process the data; “data protection officer” or “DPO” refers to any individual appointed by the data controller charged with ensuring, in an independent manner, compliance with the obligations provided for in this law; “data controller's representative” or “controller's representative”: refers to any natural person, legal person or public