21. (1) An data processor or anyone processing personal information on behalf of a data controller shall (a) process such information only with the knowledge or authorisation of the data controller; and (b) treat personal information which comes to their knowledge as confdential and shall not disclose it, unless required by law or in the course of the performance of their duties. Security measures regarding information processed by a data processor 22. (1) A data controller shall ensure that an data processor which processes personal information for or on behalf of the data controller establishes and maintains the security measures referred to in the Act. (2) The processing of personal information for a data controller by an data processor on behalf of the data controller shall be governed by by a written contract between the data processor and the data controller, which requires the data processor to establish and maintain confidentiality and security measures to ensure the integrity of the personal information. (3) Where the data processor is not domiciled or does not have its principle place of business in Lesotho, the data controller shall take reasonable steps to ensure that the data processor complies with the laws relating to the protection of personal information of the territory in which the data processor is domiciled. Notification of security compromises 23. (1) Where there are reasonable grounds to believe that the personal information of a data subject has been accessed or acquired by an authorised person, the data