No. 136 Chapter 69 Gor Government Gazette 27 May 2019 Section 38 The provisions of t h e representative designation in Section 37(5) shall not apply to the following Data Controller: (1) the Data Controller which is a public authority as prescribed and announced by the Committee, (2) the Data Controller which engages in the profession or business of collecting, using, or disclosing Personal Data, that does not have the nature pursuant to Section 26, and does not have a large amount of Personal Data as prescribed by the Committee in Section 41 (2). In the event that the Data Controller in Section 5 paragraph two has a Data Processor, the provisions of Section 37 (5) and the provisions in paragraph one shall apply to such Data Processor mutatis mutandis. Section 39 The Data Controller shall maintain, at least, the following records in order to enable the data subject and the Office to check upon, which can be either in a written or electronic form: (1) the collected Personal Data; (2) the purpose of the collection of the Personal Data in each category; (3) details of the Data Controller; (4) the retention period of the Personal Data; (5) rights and methods for access to the Personal Data, including the conditions regarding the Person having the right to access the Personal Data and the conditions to access such Personal Data; (6) the use or disclosure under Section 27 paragraph three; (7) the rejection of request or objection according to Section 30 paragraph three, Section 31 paragraph three, Section 32 paragraph three, and Section 36 paragraph one; and (8) details of the appropriate security measures pursuant to Section 37 (1). The provisions in paragraph one shall apply to the representative of the Data Controller under Section 5 paragraph two mutatis mutandis. The provisions in (1) (2) (3) (4) (5) (6) and (8) may not apply to the Data Controller who is a small organization pursuant to the rules as prescribed by the Committee, unless the collection, use, or disclosure of such Personal Data is likely to result in a risk to the rights and freedoms of data subjects, or not a business where the collection, use, or disclosure of the Personal Data is occasional, or involving in the collection, use, or disclosure of the Personal Data pursuant to Section 26. 19