(a) implementing appropriate data security and organisational measures in accordance with section 31; (b) keeping a record of all processing operations in accordance with section 33; (c) performing a data protection impact assessment in accordance with section 34; (d) complying with the requirements for prior authorisation from, or consultation with the Commissioner pursuant to section 35; and (e) designating an officer responsible for data protection compliance issues. (3) Every controller shall implement such policies and mechanisms as may be required to ensure verification of the effectiveness of the measures referred to in this section. 23. Collection of personal data (1) Subject to section 44, a controller shall not collect personal data unless – (a) it is done for a lawful purpose connected with a function or activity of the controller; and (b) the collection of the data is necessary for that purpose. (2) Subject to subsection (3), where a controller collects personal data directly from a data subject, the controller shall, at the