body or data controller party to whom the personal information has been disclosed of those steps. (5) The data controller shall notify a data subject, who has made a request in terms of subsection (1), of the outcome of the request within a period of 14 days of the making of the request. Data controller to give effect to principles/ Accountability 28 (1) The data controller shall: (a) ensure that the principles set out under this Act and all the measures that give effect to the principles are complied with and (b) have the necessary internal mechanisms in place for demonstrating such compliance to both to data subjects and to the Commission in the exercise of its powers. Prohibition on processing of sensitive personal information 29 Unless specifically permitted under this Act, a data controller shall not process sensitive personal information. Exemption on data subject’s race 31 (1) The prohibition on processing personal information concerning a data subject’s race shall not apply if the processing is carried out to – (a) identify data subjects and only when this is essential for that