controller, or any other third party processing personal information under the authority of a data controller, shall notify (a) the commission; and (b) the data subject, unless the identity of such data subject cannot be established. (2) The notification referred to in subsection (1) shall be made as soon as reasonably possible after the discovery of the compromise, taking into account the legitimate needs of law enforcement or any measures reasonably necessary to determine the scope of the compromise and to restore the integrity of the data controller’s information system. (3) The data controller shall delay notification to the data subject where the Lesotho Mounted Police Service, the National Security Service or the Commision determines that notification will impede a crimial investigation. (4) The notification to a data subject referred to in subsection (1) shall be in writing and communicated to the data subject in one of the following ways – (a) mailed to the data subject’s last known physical or postal address; (b) sent by e-mail to the data subject’s last known e-mail address; (c) placed in a prominent position on the website of the party responsible for notification; (d) published in the news media; or (e) as may be directed by the commission. (5) A person making notification shall ensure that the notification provides sufficient information to allow the data subject to take protective measures against potential consequences of the compromise, including, if known to the data controller, the identity of the unauthorised person who may have accessed or acquired the personal information. (6) The Commission may direct a data controller to publicise, in any manner